AI Hive Mind Malware: New Tool Detects Human-Free Cyber Threat

Cybersecurity researchers have unveiled a new open-source framework designed to identify and analyze malware that leverages artificial intelligence. Cisco Talos introduced the Cognitive Artifact Intelligence Research Network (CAIRN) on Monday, aiming to provide defenders with the tools necessary to track the growing prevalence of AI-integrated hacking tools. This initiative addresses a shifting threat landscape where attackers are increasingly embedding agentic AI components into their malicious software, moving beyond traditional static code to dynamic, decision-making threats.

The framework’s name draws inspiration from cairns, the stone stacks hikers use to mark trails, symbolizing CAIRN’s role in marking the path through complex digital forensics. By analyzing metadata and specific integration characteristics, CAIRN generates unique identifiers for malware samples, allowing analysts to classify them and detect emerging trends. Since its development, the tool has already helped uncover approximately 20 additional instances of AI-enabled malware, revealing a more diverse and active ecosystem than previously reported by the public sector.

Tracking the Invisible Fingerprints of AI Malware

Ryan Fetterman, a security researcher at Cisco Talos who led the creation of CAIRN, emphasizes that integrating AI leaves behind distinct technical signatures. “The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,” says Ryan Fetterman, a security researcher at Cisco Talos who led development of CAIRN. “That gives us a signal that we can use to track these samples, classify them, and look at what’s happening. What are attackers trying? What kind of emergent behaviors are we seeing? That’s a valuable resource to the defensive community as these things become more mainstream.”

Fetterman’s motivation to build CAIRN stemmed from a discrepancy between early warnings and actual field data. In July 2025, the Ukrainian cybersecurity unit CERT-UA alerted the industry to a phishing campaign involving malware dubbed “LAMEHUG.” This implant communicated with the large language model (LLM) Qwen2.5-Coder-32B-Instruct via a Hugging Face API to receive commands. The event signaled a potential tipping point for AI-driven attacks. “At the time I was like, ‘Wow, this is amazing. There’s gonna be this big boom of AI-enabled malware and the landscape is totally going to change,’” Fetterman says.

However, when Fetterman conducted a retrospective analysis of AI-integrated malware later that year, he found the reality starkly different from his initial expectations. He discovered only a handful of documented examples, including some research proofs of concept. “There really wasn’t a lot there. I think I came up with maybe nine different named malware families,” and some of those were proofs of concept created for research, he says. “It just wasn’t what I was expecting, and I think I also had a hard time believing that that was the reality of where we were. So I wanted to start digging into that.”

The Rise of Autonomous Command Structures

The investigation using CAIRN led to the discovery of a sophisticated Windows-based threat named CLOSEDQUORUM. This malware represents a significant evolution in autonomous cyber threats because it operates without human intervention. It achieves this by polling multiple large language models, including DeepSeek, Qwen, Mistral, and Google Gemini, to establish a consensus on its next actions. This multi-model approach ensures redundancy; if one service is unavailable, the malware continues to function by consulting the others.

Cisco Talos researchers identified links between CLOSEDQUORUM and cybercriminal forums discussing credit card fraud dating back to 2025. The malware is engineered to steal login credentials and cryptocurrency, utilizing the collective intelligence of the queried AI models to navigate target systems. While the developers remain unidentified and real-world deployment has not been confirmed, the tool demonstrates the viability of fully autonomous command-and-control infrastructure.

Matt Olney, senior director of threat intelligence at Cisco Talos, notes that the perception of AI in cybercrime is shifting from experimental to operational. “Initially, everyone saw AI as a productivity tool, right?” says Matt Olney, senior director of threat intelligence at Cisco Talos, referring to both legitimate work and malicious hacking. “Now what we’re seeing is that it’s becoming operationalized. So for attackers, it’s allowing them to run more campaigns, hit more spaces, handle more and different computers, because they have this very intelligent box in the backend that can ask questions and give responses.”