Cisco Talos has released CAIRN, an open-source research toolkit designed to help defenders identify, classify and track malware that incorporates artificial intelligence into its operations.
The tool focuses on traces left when developers connect large language models and AI services to malicious software.
CAIRN, short for Cognitive Artifact Intelligence Research Network, uses metadata to identify possible AI-linked malware without requiring analysts to immediately download or execute suspicious binaries.
What Is CAIRN Designed to Find?
CAIRN searches for what Cisco Talos describes as “cognitive artifacts,” or traces created when developers integrate large language models and AI services into malicious tools.
These artifacts can include embedded prompt templates, AI provider endpoints, API key prefixes, jailbreak language, orchestration logic, local model runtime references and text intended to evade AI-assisted malware analysis.
Rather than treating the presence of an AI reference as proof that a file is malicious, CAIRN compares these artifacts with behavioural context and known malware-family indicators. Analysts can then use conventional reverse engineering to validate the findings and attribute suspicious samples.
How Does the Tool Hunt AI-Linked Malware?
CAIRN follows a metadata-first approach. It can process metadata exposed by sources such as VirusTotal, including printable strings, extracted URLs and domains, antivirus detection labels, PE resource fields, import-related indicators and sandbox behaviour.
This approach allows analysts to investigate potentially relevant samples without initially relying on binary execution or local detonation.
The framework provides up to 24 acquisition filters that can be used to identify potentially relevant files.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What AI Clues Can CAIRN Detect?
The filters can look for domains belonging to AI providers, including OpenAI, Anthropic, DeepSeek and Google Generative Language API endpoints.
CAIRN can also identify references to Python AI frameworks such as LangChain and LiteLLM, OpenAI-related imports and local inference tools including Ollama, llama.cpp, vLLM, GGUF and SafeTensors.
Another category involves agentic tool-calling patterns, including terms such as tool_call, tool_calls and function_call, when they appear alongside offensive capability indicators.
It can also identify natural-language instructions that appear intended to suppress or mislead AI-based analysis systems.
How Does CAIRN Separate Clues From Stronger Evidence?
CAIRN stores candidate information in a SQLite corpus and automatically applies YARA rules during import. This allows analysts to distinguish basic AI-related indicators from stronger signs that AI is being used operationally.
The toolkit can create relationship graphs connecting suspicious samples with related infrastructure, variants, companion payloads and possible campaign links.
Artifacts can be linked through attributes such as shared domains, submitters, import hashes and references to AI providers.
CAIRN also uses embeddings and clustering techniques including UMAP and HDBSCAN to identify samples with semantically similar metadata even when they do not share obvious strings.
However, cluster membership is treated only as a weak similarity signal rather than confirmed attribution. Individual candidates still require analyst inspection and reverse engineering.
What Malware Has Been Analysed With CAIRN?
Cisco Talos introduced CAIRN alongside its analysis of CLOSEDQUORUM, a Windows implant that delegates tactical command-and-control decisions to a panel of commercial large language models.
The malware can query DeepSeek, Qwen, Mistral and Google Gemini from a predefined menu to select actions including credential theft, persistence and code injection.
CLOSEDQUORUM does not require continuous instructions from a human operator or a conventional attacker-controlled command-and-control server after deployment. However, there has been no confirmed in-the-wild deployment of the sample.
Why Could CAIRN Matter for Malware Research?
CAIRN is intended as a research tool rather than a standalone malware detection signal. Its value lies in giving defenders a structured method for tracking an emerging category of malicious software as AI integrations become more common.
The approach also recognises an important limitation: simply finding an AI-related string, API reference or model name inside a suspicious file does not establish malicious AI use.
By combining metadata, relationships, behavioural indicators and conventional malware analysis, researchers can investigate whether AI components are genuinely being used as part of malicious operations.
The420 Takeaway: “Malware Is Learning to Use AI, Defenders Are Learning to Track Its Footprints”
CAIRN focuses on the traces left behind when AI services, models and frameworks are integrated into suspicious software. As AI becomes another component available to malware developers, identifying those technical footprints could help researchers separate ordinary AI references from malware that is actually using the technology during its operations.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
