[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4HQX2__MLSFeXgk4ihW5Gba5IuL5NTciR8itLIevdvs":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"7babe506-35c4-4576-ba10-3fccb4974090","A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight","a-new-tool-found-malware-that-s-guided-by-an-ai-hive-mind-no-humans-in-sight-5efa3d","Cisco Talos researchers created a new framework for identifying malware and hacking tools that rely on AI chatbots—and quickly discovered something unusual.","Cisco Talos has developed an open-source framework called CAIRN to identify and classify malware that leverages AI chatbots. Using CAIRN, researchers discovered CLOSEDQUORUM, a Windows malware that autonomously uses multiple LLMs for command and control, with no human intervention. This tool is designed to steal credentials and cryptocurrency, and has been linked to credit card fraud forums.","Cisco Talos unveils CAIRN framework to detect AI-driven malware, identifying CLOSEDQUORUM.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fa-tool-for-tracking-ai-integrated-malware-uncovered-an-autonomous-command-system\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6ab1b117c967476bab903a3e\u002Fmaster\u002Fpass\u002FSecurity_CommandCenter_v4.jpg","2026-09-22T10:00:00+00:00","2026-09-22T12:00:12.949352+00:00",8,[17,20,23,26],{"name":18,"type":19},"CAIRN","product",{"name":21,"type":22},"Cisco Talos","vendor",{"name":24,"type":25},"LLM","technology",{"name":27,"type":19},"Qwen2.5-Coder-32B-Instruct","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":32,"value":51,"context":52},"CLOSEDQUORUM","AI-driven malware identified by Cisco Talos CAIRN framework.",{"type":32,"value":54,"context":55},"LAMEHUG","Phishing campaign implant that communicated with an LLM.",[21,18,27],{"controls":58,"vendors":141},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":48,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":43,"name":117,"problem":118,"products":119},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[120,125,133],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":121,"product_name":122,"url":123,"description":124},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[142],{"slug":143,"name":144,"logo_path":145,"roles":146},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"ai-driven-malware-operates-autonomously-using-llms-for-command-control","AI-Driven Malware Operates Autonomously Using LLMs for Command & Control","CLOSEDQUORUM represents a paradigm shift in malware sophistication, using multiple large language models as a fully autonomous command-and-control infrastructure — eliminating the need for human operator involvement. This means traditional detection techniques that look for human-patterned C2 traffic or known malicious domains may fail entirely, as LLM-based communications can appear benign or mimic legitimate API usage. The malware targets credentials and cryptocurrency wallets, amplifying financial and identity theft risks. Organizations relying solely on signature-based defenses or human behavioral analysis are particularly exposed to this new class of AI-guided threats. The emergence of tools like CAIRN underscores that defenders must now account for AI-to-AI threat ecosystems in their detection strategies.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 3 – Data Protection","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST CSF DE.AE – Anomalies and Events Detection","MITRE ATT&CK T1071 – Application Layer Protocol (C2)","MITRE ATT&CK T1539 – Steal Web Session Cookie","GDPR Article 32 – Security of Processing (credential\u002Fdata protection obligations)",{}]