1 66984

www.snort.org • September 23, 2026

MALWARE-CNC -- Snort has detected a Comand and Control (CNC) rule violation, most likely for commands and calls for files or other stages from the control server. The alert indicates a host has been infiltrated by an attacker, who is using the host to make calls for files, as a call- vector for other malware-infected networks, for shuttling traffic back to bot owners, etc.

MALWARE-CNC Win.Rat.ClosedQuorum outbound connection attempt

This rule looks for specially crafted LLM chat completion messages associated with Win.Rat.ClosedQuorum. ClosedQuorum is an autonomous agent like malware that uses commercial cloud models to drive its execution on infected environment.

This rule alerts on AI prompt queries from Win.Rat.ClosedQuorum.

Attacks/Scans seen in the wild

No known false positives

Cisco Talos Intelligence Group

MITRE::ATT&CK Framework::Enterprise::Command and Control::Application Layer Protocol

Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Rule Categories::Malware::Command and Control

Rules for detecting malware command and control traffic

No information provided

CVE Additional Information

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco Talos Launches CAIRN to Combat AI-Integrated Malware On September 22, 2026, Cisco Talos released CAIRN, an open-source toolkit designed to hunt, classify, and track AI-integrated malware. The first documented malware analyzed with CAIRN is CLOSEDQUORUM, a Windows implant that autonomously delegates command-and-control decisions to commercial large language models (LLMs). CAIRN identifies cognitive artifacts left by malware, such as API keys and prompt templates, without needing to download or execute the malware. It utilizes metadata to classify malware samples into three tiers based on the presence and operational use of AI-related artifacts. The toolkit aims to enhance the detection of emerging threats in the evolving landscape of AI-integrated cyberattacks. The release follows the identification of AI-specific evasion techniques spreading among attackers, underscoring the urgency of this new threat landscape. 26 sources 73

Extracted Entities

1 66984

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)