Introducing CAIRN: Frontier tracking for AI-integrated malware

Cisco Talos has released CAIRN, a new research toolkit designed to identify and track AI-integrated malware. CAIRN utilizes a metadata-first approach, focusing on identifying AI-related artifacts like API endpoints, tool-call syntax, and evasion strings, without requiring binary downloads. Initial findings show a rapid escalation in AI-specific tradecraft, with techniques like LLM sandbox evasion spreading independently across various actors. CAIRN’s tiered YARA rules and semantic clustering capabilities allow analysts to build a comprehensive understanding of AI-integrated malware campaigns and trends, offering a scalable complement to traditional reverse engineering.

CAIRN operates entirely from metadata – no binary downloads or execution required. It combines rule-based detection, semantic clustering, and relationship graph traversal to identify AI-integrated malware through cognitive artifacts such as embedded prompts, provider endpoints, orchestration logic, API key prefixes, and AI-analysis evasion strings.

CAIRN discovers candidate samples through up to 24 acquisition filters, each targeting a different type of AI-related artifact. For example, the ‘provider-api-integration’ filter searches for LLM provider endpoint strings in file metadata, such as `api.openai.com`, `api.anthropic.com`, and `api.deepseek.com`. The ‘python-ai-scripts’ filter targets Python files matching AI framework import patterns, like `langchain`, `litellm`, and `openai`. The ‘ai-analysis-evasion’ filter searches for text strings explicitly addressed to AI analysis systems – the kind of comment an actor might embed when trying to tell an LLM sandbox "there's nothing to see here." The ‘local-llm-runtime’ filter searches for strings indicating local model inference (e.g., `ollama`, `llama.cpp`, `vllm`, `gguf`, `safetensors`). The ‘agentic-tooling’ filter looks for tool-call syntax (e.g., `tool_call`, `tool_calls`, `function_call`) co-occurring with offensive capability terms.

Results from the acquisition filters are stored in a SQLite corpus with YARA run automatically on import, using a three-layer ontology: Tier 1 (T1) Primitive AI Artifacts (e.g., API endpoints, tool calling syntax) establishes that AI-related artifacts are present; Tier 2 (T2) Behavioral Context (e.g., AI analysis evasion, known C2 methods) adds behavioral context by identifying combinations of artifacts that suggest operational use of AI; and Tier 3 (T3) Operational Families (named AI-enabled malware family) performs family attribution using confirmed operational fingerprints.

Analysis methods with CAIRN include:

1. **Acquisition filters for sample corpus expansion:** Discover previously unseen samples using filters. 2. **Relationship-based pivoting:** Expand outward through metadata relationship graphs to identify related malware, shared infrastructure, and other artifacts. 3. **YARA-based triage and classification:** CAIRN’s YARA rules operate on scan text derived from sample metadata in a three-tier structure (T1 artifacts, T2 behaviors, T3 confirmed families). 4. **Semantic discovery:** YARA finds what you already know to search for. Embedding models can identify samples that are semantically similar even when they share no obvious string overlap. CAIRN treats semantic clustering as a complementary discovery mechanism rather than a replacement for YARA.

Talos’ initial hunts with CAIRN have targeted active malware development since July 2025, when the first AI-integrated samples were reported in the wild (LAMEHUG, CERT-UA). Initial observations include:

• An autonomy escalation arc, rapidly changing from “LLM as optional feature” to “fully autonomous multi-model consensus orchestrator with no human operator” within a single year.
• AI-specific tradecraft is being taught and spread. An AI-analysis evasion technique, embedding natural-language suppression text addressed to LLM sandboxes, was traced to a named red team instructor and appeared in independent actor samples, within 12 months of its first confirmed in-the-wild use.
• “No free lunch,” “Not a silver bullet” statement. T1/T2 hits without genuine AI integration are common. For example, PyInstaller bundles expose the developer's entire virtual environment as YARA-visible strings regardless of what the application imports; Tauri-framework apps and certain Go PE structures accumulate detection signatures from structural similarity alone.
• We may be in a fleeting window to observe AI transition. AI integration is becoming commonplace in all software. As this integration increases, our filters will need to shift from an emphasis on presence of AI strings, toward purpose of their integration. The current approach emphasizes T2 YARA to sharpen behavior classification over the presence of AI indicators alone. Final verdicts for all findings still need validation through reverse engineering.

Cisco Talos concludes that CAIRN is a research effort, not a pure active threat signal. However, for the security community, the insights gleaned from studying this landscape and its progression form a valuable signal to inform our detection, intelligence, and operational strategies. Talos hopes to refine filters, rules, and reporting via community-driven improvements by open-sourcing CAIRN.