CAIRN Unveils Tracking for AI-Integrated Malware

• •CAIRN is a new framework for tracking AI-integrated malware developed by Cisco Talos.
• •The tool has already identified a malware variant called CLOSEDQUORUM, which uses AI for command-and-control.
• •CAIRN operates on a metadata-first approach, enabling rapid identification without executing binaries.

Cisco Talos has launched CAIRN, a new framework for identifying and classifying AI-integrated malware. This tool utilizes cognitive artifacts left by malware authors, such as API keys and prompt templates, to track and analyze malware behavior without needing to execute binaries. CAIRN has already identified a malware variant called CLOSEDQUORUM, which uses multiple large language models for autonomous command-and-control. The framework aims to enhance the cybersecurity community's ability to respond to the evolving threat landscape posed by AI-integrated malware. Researchers have discovered 20 new examples of such malware using CAIRN, indicating a growing trend in AI-enabled cyber threats. The tool operates on a metadata-first architecture, allowing for rapid identification and classification of threats. This development comes amid increasing concerns about the integration of AI in cyberattacks, as seen in previous incidents like the LAMEHUG malware campaign.