For years, cybersecurity experts have tracked various types of malware, using digital fingerprints to identify infections over time. With the rise of AI in hacking tools, Cisco Talos researchers have introduced an open-source framework aimed at classifying and analyzing AI-integrated malware. They’ve named this framework the Cognitive Artifact Intelligence Research Network (CAIRN), likening it to the stone stacks that hikers create to mark trails.
As malware creators increasingly incorporate AI services, CAIRN has already identified a notable example known as CLOSEDQUORUM. This malware employs autonomous command-and-control systems, polling multiple large language models (LLMs) to determine its actions, fundamentally bypassing any human input. Ryan Fetterman, a security researcher with Cisco Talos, points to the unique identifiers and metadata left by AI-integration as crucial signals for tracking and categorizing these samples.
In a recent investigation, Fetterman and his team were surprised to discover only a handful of instances of AI malware in public records. However, with the application of CAIRN, they uncovered about 20 additional examples of AI-integrated malware, indicating that the complexity of this landscape has been underestimated.
CLOSEDQUORUM communicates with LLMs like DeepSeek and Google Gemini to decide on its operations, showcasing a robust design resistant to human oversight. While some evidence links this malware to cybercriminal forums, the identity of its developer remains unknown, as does whether it has been used in actual attacks. This development illustrates how attackers are leveraging advanced AI capabilities to enhance their operations, allowing them to successfully orchestrate more campaigns and target multiple systems simultaneously.
Cisco Talos emphasizes the need for the cybersecurity community to adapt to these trends. As the integration of AI in cyberattacks becomes more mainstream, there’s an urgent requirement for tracking tools like CAIRN to help mitigate emerging threats.
