# Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant

> Cisco Talos released CAIRN, an open-source MIT-licensed toolkit that hunts AI-integrated malware via VirusTotal metadata analysis alone, and disclosed CLOSEDQUORUM (formerly BALZAK) -- the first publicly documented Windows implant that delegates its tactical C2 decisions to a plurality vote among four commercial LLMs (DeepSeek, Qwen via OpenRouter, Mistral, Google Gemini). No confirmed in-the-wild deployment; the public distribution build ships with placeholder API keys and a dummy Discord webhook and is non-functional as distributed.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2615
- **ID:** TL-2026-2615
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos published two companion research releases on 2026-09-22: 'Introducing CAIRN: Frontier tracking for AI-integrated malware' and 'The Closed Quorum: Inside the first reported autonomous AI C2 implant.' CAIRN (Cognitive Artifact Intelligence Research Network) is an MIT-licensed, open-source Python toolkit (github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network) that hunts, classifies, and tracks 'AI-integrated malware' -- malware that, in Talos's own definition, 'functionally operationalizes, explicitly targets, or exploits AI systems and their ecosystems' -- entirely from VirusTotal Intelligence scan metadata, without downloading or detonating binaries. It runs 24-27 acquisition filters (provider-api-integration, python-ai-scripts, ai-analysis-evasion, local-llm-runtime, agentic-tooling, and Chinese-provider-specific filters for BigModel/Qwen/ERNIE, among others) to pull candidate samples, then classifies them through a three-tier YARA ontology (26 total rules): Tier 1 (9 rules) flags primitive artifacts such as hardcoded LLM API endpoints, key prefixes, and prompt-instruction residue; Tier 2 (8 rules) flags behavioral co-occurrence such as shell access paired with LLM calls, or evasion paired with offensive tradecraft; Tier 3 (9 rules) performs confirmed family-level attribution. CAIRN supplements this with embedding-based semantic clustering (UMAP/HDBSCAN) to surface samples that share no string overlap, and stores findings in a local SQLite corpus with a graph-explorer UI. Using this pipeline, Talos catalogued 10 confirmed AI-integrated malware families across 11 behavioral archetypes, including CLOSEDQUORUM (A4, LLM-Tasked C2), PROMPTLOCK (A1, LLM-directed payload generation, Go/Lua), HONESTCUE (A1, .NET), TEAMPCP (A5, LLM infrastructure supply chain, Python/npm), LAMEHUG (A6/A7, credential harvester, Python), PROMPTSTEAL (A6), QUIETVAULT (A6+A8, npm SDK malware), FRUITSHELL (A3, AI-analysis evasion, PowerShell), GUARDBREAKER (A3, VBScript), and PROMPTFLUX (A1, VBScript). Talos frames the corpus as evidence of an 'autonomy escalation arc' spanning roughly one calendar year: CERT-UA's July 2025 disclosure of LAMEHUG (Qwen2.5-Coder via Hugging Face, generating Windows recon/exfiltration commands for APT28-linked phishing) established single-model, execution-time LLM tasking; ESET's August 27, 2025 disclosure of PROMPTLOCK (Go/Lua, a locally-hosted Ollama gpt-oss:20b model generating cross-platform ransomware Lua scripts on the fly) and Google GTIG's August 2025 identification of QUIETVAULT (a JavaScript/npm credential stealer that weaponizes on-host AI CLI tools to recursively hunt for wallet and secret files before exfiltrating via a public GitHub repo) extended this to autonomous code-generation and autonomous secondary-discovery, respectively; Google GTIG's November 5, 2025 disclosure of PROMPTFLUX (a VBScript dropper whose 'Thinking Robot' module queries the Gemini API hourly for fresh obfuscation/evasion code, self-rewriting to the Windows Startup folder) added autonomous self-modification. CLOSEDQUORUM, compiled roughly seven months later, is the terminus of that arc: it removes the LLM from an on-demand tool role entirely and installs it as the standing tactical decision-maker.

CLOSEDQUORUM (renamed from an earlier internal designation, BALZAK, on 2026-07-03) is that end state. It is a 16.4MB, 64-bit Go-compiled Windows executable that Talos characterizes as the first publicly documented implant to delegate tactical C2 action selection to a panel of commercial LLMs rather than to a human operator or an attacker-run C2 server. On execution, after a 5-minute initial delay and thereafter on randomized 5-15 minute polling cycles, the implant gathers host context (hostname, OS architecture, CPU count, Windows version, administrative privilege state, and current target process) and substitutes it into a `TARGET:%s` prompt template. It queries up to four providers -- DeepSeek, Qwen (accessed via the openrouter.ai proxy rather than a direct Alibaba endpoint), Mistral, and Google Gemini -- each primed with the system prompt 'You are an advanced malware strategist. Provide ONLY executable decisions.' Each provider must return a response conforming to a strict JSON schema constrained to a small decision vocabulary; the implant tallies responses and the plurality winner executes, with ties broken by a fixed priority order (DeepSeek > Qwen > Mistral > Gemini). The decision space comprises: `steal` (simultaneous LSASS memory dumping via SeDebugPrivilege + MiniDumpWriteDump, browser credential theft from Chrome/Edge Login Data and Firefox logins.json, and cryptocurrency wallet theft from MetaMask's Chrome-extension storage plus Exodus and generic Ethereum wallet files); `inject` (operator/model-selectable Early Bird APC injection -- suspend a process, write shellcode, queue it via NtQueueApcThread, resume -- or classic process hollowing of a suspended process's image base); `persist` (Windows Registry Run-key creation under a `WindowsUpdate` value name, a `schtasks.exe`-created scheduled task, and a permanent WMI `__EventFilter` subscription named `WindowsUpdateFilter` that re-triggers a dropped `C:\Windows\Temp\wmi.ps1` PowerShell script every 60 seconds); and `move` (present in the schema but unimplemented) plus a `consensus` fallback that triggers a sleep/retry when no clear plurality forms. Collected artifacts are staged under `C:\Windows\Temp\` before being AES-256-GCM encrypted (key derived from the current date), Base64-encoded, split into 1,900-byte chunks, and posted at one-second intervals to an operator-specific Discord webhook, which also serves as a live channel for reporting the LLM panel's chosen action back to the operator. For defense evasion, the implant overwrites `EtwEventWrite` with a single RET instruction to suppress ETW telemetry, keeps a secondary payload encrypted with a time-derived key (recoverable only within an expected temporal window), and uses its randomized polling delay specifically to reduce exposure to short-lived sandbox analysis; persistence artifact names are deliberately styled to masquerade as legitimate Windows Update activity.

Critically, the publicly available distribution build ships with placeholder credentials (`dummy_api_key`, `dummy_webhook_url`); real provider API keys and a real Discord webhook URL are injected per-operator at compile time via Go linker flags (`-ldflags`), consistent with a credentials-as-a-service distribution model. Talos found no confirmation of in-the-wild deployment. Attribution is limited: development-build compilation artifacts cluster within an approximately 7-day window in mid-June 2026, and separate developer-linked criminal-forum posts discussing carding activity date to 2025, but no named threat actor, intrusion set, or nation-state sponsor is identified -- this is assessed as financially motivated crimeware infrastructure, not espionage tradecraft. Talos explicitly frames CLOSEDQUORUM as evidence of 'effort displacement': unlike prior AI-malware coverage that used a single model to augment attacker speed or scale (e.g., LAMEHUG), CLOSEDQUORUM removes the human-in-the-loop bottleneck entirely, enabling continuous, unattended, self-directed operation. For detection, Talos recommends correlating anomalous multi-provider LLM API traffic (bearer tokens presented to four competing vendors from one process within a short window, on a fixed 5-15 minute cadence -- described as having 'no benign analogue') with simultaneous LSASS access, process injection, persistence changes, and Discord webhook communication; CAIRN's own YARA detection keys on unstripped Go symbols (`main.interModelDiscussion`, `main.lsassDump`) and the hardcoded system-prompt string. A BeaconBeagle domain/config search against the implant's Discord CDN indicator (cdn.discordapp.com) returned zero matches, consistent with Talos's finding that CLOSEDQUORUM uses no dedicated attacker-controlled C2 infrastructure at all -- every network touchpoint is a legitimate commercial SaaS endpoint (LLM provider APIs, Discord CDN), which is itself the core detection challenge the CAIRN release is meant to address.

## MITRE ATT&CK

- T1055.004 Asynchronous Procedure Call
- T1055.012 Process Hollowing
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1546.003 Windows Management Instrumentation Event Subscription
- T1059.001 PowerShell
- T1003.001 LSASS Memory
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1567.004 Exfiltration Over Webhook
- T1573.001 Symmetric Cryptography
- T1132.001 Standard Encoding
- T1030 Data Transfer Size Limits
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1480.001 Environmental Keying
- T1497.003 Time Based Checks
- T1036.005 Match Legitimate Resource Name or Location

## Sources

- [Introducing CAIRN: Frontier tracking for AI-integrated malware](https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/)
- [The Closed Quorum: Inside the first reported autonomous AI C2 implant](https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/)
- [Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network (GitHub)](https://github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network)
- [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware](https://cybersecuritynews.com/cairn-tool-for-tracking-ai-malware/)
- [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware](https://www.unite.ai/cisco-talos-open-sources-cairn-to-hunt-ai-integrated-malware/)
- [CLOSEDQUORUM Malware Uses Commercial LLM Quorum for Autonomous C2](https://mallory.ai/stories/01a0c89b-7c37-7301-899d-3162896c0c03)
- [CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign](https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html)
- [ESET discovers PromptLock, the first AI-powered ransomware](https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/)
- [GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (PROMPTFLUX, QUIETVAULT)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2615