Cisco Talos Unveils CAIRN, an AI-Integrated Malware Detector

Cisco Talos has released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit for hunting, classifying, and tracking emerging AI-integrated malware. The accompanying findings series opens with CLOSEDQUORUM, which Talos described as, to its knowledge, the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs).

The toolkit operates entirely from metadata, with no binary downloads or execution, combining rule-based detection, semantic clustering, and relationship graph traversal. CAIRN builds a structured graph of cognitive artifact relationships to help defenders identify related malware families, infrastructure, and threat actors.

CAIRN's explorer layer discovers candidate samples through up to 24 acquisition filters, each targeting a different type of AI-related artifact across extracted strings, sandbox behavior, and antivirus detection labels. The acquired results are stored in a SQLite corpus, with YARA rules run automatically on import under a three-layer ontology.

CAIRN supports four analysis strategies: acquisition filters for corpus expansion, relationship-based pivoting, YARA-based triage and classification, and semantic discovery. Talos said its initial CAIRN hunts have targeted active malware development dating back to July 2025, when the first AI-integrated samples were reported in the wild with LAMEHUG.