Cisco Talos Launches CAIRN Framework to Classify AI-Driven Malware

Cisco Talos released CAIRN, an open-source framework for classifying malware with integrated AI components. Using it, researchers identified CLOSEDQUORUM, Windows malware that polls DeepSeek, Qwen, Mistral and Gemini for commands and operates with no human input.

• CAIRN tags samples by AI-integration fingerprints and groups them by traits
• CLOSEDQUORUM polls up to four LLMs and runs with no human in the loop
• The malware steals credentials and crypto, with links to 2025 carding forums
• Talos found about 20 new AI-integrated malware samples after launching CAIRN