Talos Opens CAIRN After CLOSEDQUORUM Lets Four LLMs Vote on Malware Moves

Cisco Talos published two linked primaries on September 22, 2026: CAIRN, an MIT-licensed research toolkit for hunting malware that wires AI into the attack chain, and a detailed static analysis of CLOSEDQUORUM, which Talos calls the first publicly documented Windows implant that hands tactical command-and-control decisions to a panel of commercial large language models. The public distribution build does not run end to end—API keys and the Discord webhook are placeholders—but development builds show compile-time injection of live credentials, and the decision loop is fully present in the binary.

CLOSEDQUORUM is a 16.4 MB 64-bit Windows executable written in Go (with CGO for direct system calls). After it lands, it does not wait for an attacker-operated C2 server to issue the next task. Instead a ModelOrchestrator queries up to four providers—DeepSeek, Qwen, Mistral, and Google Gemini—with a constrained prompt that includes host context (hostname, Windows version, CPU count, admin status) and a fixed action vocabulary. Each model must return typed JSON. Responses that fail the schema are discarded. Surviving votes feed interModelDiscussion(), which tallies the Decision field by plurality. Ties break deterministically toward DeepSeek, then Qwen, then Mistral, then Gemini. If nothing usable comes back, the implant sleeps and retries rather than inventing a default action.

The allowed decisions map to concrete modules. steal runs LSASS dumping, browser credential collection for Chrome, Edge, and Firefox, and crypto-wallet extraction aimed at MetaMask, Exodus, and Ethereum paths in one pass. inject generates shellcode and branches between Early Bird APC injection and process hollowing depending on the model’s exploit-type field. persist installs a Registry Run value themed as Windows Update, a scheduled task, and a permanent WMI event subscription that restarts the implant about every sixty seconds. move appears in the schema but has no handler in the distribution build Talos examined. Stolen material is staged under C:\Windows\Temp\, encrypted with AES-256-GCM using a date-derived key, Base64-encoded, split into 1,900-byte chunks, and posted one chunk per second to a Discord webhook that also receives the winning vote and the models’ reasoning text.

That architecture is what Talos frames as effort displacement: not merely AI writing faster phishing copy, but moving an entire post-compromise phase off the human operator. The operator still configures Discord and API keys at build time and watches telemetry, yet the implant can keep choosing steal, inject, or persist without live tasking. The same design creates brittle edges defenders can use—provider refusals, rate limits, malformed JSON, predictable tie-breaking, and the odd combination of multi-provider AI traffic with LSASS access, process injection, or WMI persistence. Talos published SHA-256 hashes for six development builds and a YARA rule oriented at VirusTotal metadata plus binary strings such as the system prompt “You are an advanced malware strategist. Provide ONLY executable decisions.”

CAIRN (Cognitive Artifact Intelligence Research Network) is the hunting side of the same release. The package name is cisco-cairn 0.1.0, MIT-licensed under Copyright 2026 Cisco Systems, Inc. and its affiliates, with the public repository mirrored as Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network (and fetterm4n/CAIRN as the pyproject Repository URL). It requires Python 3.11 or newer and works from VirusTotal metadata only—no binary download or detonation in the default path. Acquisition filters (Talos describes up to twenty-four) look for LLM provider endpoints, AI framework imports, tool-call syntax co-occurring with offensive terms, local-runtime strings such as ollama or gguf, and natural-language strings aimed at LLM sandboxes. Hits land in a SQLite corpus; a three-tier YARA ontology labels primitive artifacts (T1), behavioral co-occurrence (T2), and named operational families (T3). Optional embedding extras cluster scan text with sentence-transformers, HDBSCAN, and a graph explorer so analysts can pivot on shared submitters, import hashes, or provider domains. The published tree omits the SQLite findings database for copyright reasons; operators with a VT Intelligence key rebuild it from published hashes and filters.

For Writeble’s AI-security desk, the pair matters because both halves are concrete and dated. CLOSEDQUORUM shows how agent-style tool schemas and multi-model voting can be inverted into offensive autonomy without a classic C2 domain. CAIRN gives defenders an open, MIT-licensed way to search for the cognitive residue—prompts, provider URLs, key prefixes, orchestration symbols—those designs leave behind. Talos is explicit that the public sample is an early, limited specimen and that many T1/T2 hits will be noise from PyInstaller or framework metadata. The September 22 disclosure still sets a measurable baseline: when malware starts treating frontier APIs as a jury, the hunting toolkit has to speak the same language.