Talos releases CAIRN, uncovers LLM-voting malware CLOSEDQUORUM

Cisco's Talos threat-intelligence team has publicly documented a Windows malware sample that hands its command-and-control decisions to four commercial large language models: DeepSeek, Qwen, Mistral and Google Gemini. The implant picks each next action by plurality vote, with DeepSeek breaking ties. Talos surfaced it using CAIRN, a new open-source toolkit released the same day, according to Wired's report.

CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable written in Go. Its system prompt instructs the model, "You are an advanced malware strategist. Provide ONLY executable decisions," and constrains each response to a small JSON schema of actions: steal, inject, persist, or move. Documented capabilities include LSASS credential dumping, browser-credential theft from Chrome, Edge and Firefox, cryptocurrency-wallet extraction from MetaMask, Exodus and Ethereum wallets, Early Bird APC injection and process hollowing, and Discord-webhook exfiltration protected with AES-256-GCM.

The sample Talos analysed is a non-functional template shipped with dummy API keys. In the developer's model, Talos writes, binaries are customised per operator with real credentials injected at compile time. Talos has not confirmed any real-world deployment.

CAIRN, the Cognitive Artifact Intelligence Research Network, takes the opposite tack from a normal sandbox. It searches metadata for prompt templates, provider endpoints, API-key prefixes, jailbreak terms and orchestration logic "without downloading or executing binaries," applying up to 24 acquisition filters and a three-tier classification that runs from primitive AI artifacts through behavioural context to family attribution.

The earlier reference point Talos cites is LAMEHUG, first reported by CERT-UA in July 2025, which used Alibaba's Qwen model through Hugging Face to generate commands mid-attack. CLOSEDQUORUM, security researcher Ryan Fetterman writes, goes a step further: "The complete dynamic operation is delegated to the AI." The public build does not run, but static analysis, Talos says, exposed the full autonomous loop.