Skip to content

Back to the catalog

CAIRN — Cisco Talos AI-Malware-Hunting Toolkit
github.comrepo

CAIRN — Cisco Talos AI-Malware-Hunting Toolkit

CAIRN is a Cisco Talos research toolkit that identifies and attributes AI-integrated malware purely from VirusTotal metadata — no binary downloads or detonation — by running a tiered YARA ontology (T1/T2/T3) over composed scan text (AV strings, PE resources, Sigma/sandbox behavioral data, embedded URLs) and layering on sentence-transformer embeddings with HDBSCAN clustering for semantic family attribution. It has produced confirmed family reports for AI-malware such as PROMPTLOCK, LAMEHUG, PROMPTSTEAL, QUIETVAULT, CLOSEDQUORUM, and FRUITSHELL, each cross-verified by hands-on Talos reverse engineering before publication.

TL;DR Cisco Talos' metadata-only CLI toolkit uses tiered YARA rules and embedding clustering over VirusTotal data to attribute AI-integrated malware families.
Open original ↗
Document

What it is

CAIRN is a runnable Python CLI (cairn), not just a research concept. The public repo ships the rule ontology, acquisition filters, and code — but not the SQLite findings database, which is withheld for copyright reasons. You rebuild it yourself from the published report hashes and acquisition filters using your own VT key. Note the actual clone URL differs from the catalog title's org path: github.com/fetterm4n/CAIRN.git. MIT licensed, copyright 2026 Cisco Systems.

Preconditions

  • Python 3.11+.
  • A VirusTotal Intelligence subscription (paid) — required for the content-based search (content: clauses) that the acquisition filters depend on. A free VT key is not enough.
  • Optional PromptIntel API key for IOC feed sync; optional [embed] extra for sentence-transformers/HDBSCAN clustering.

What to do

git clone https://github.com/fetterm4n/CAIRN.git
cd CAIRN
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
cp .env.example .env          # set VT_API_KEY (required)
pip install -e ".[embed]"     # for clustering

Verify and run the core loop:

cairn validate-rules                       # expect 26 rules, valid: true
cairn pull --filter python-ai-scripts --limit 25
cairn summary
cairn refresh --sha256 <sha256> --behaviours
cairn rescan                               # re-run rules, no API calls
cairn cluster --min-cluster-size 3
cairn explorer                             # local graph + UMAP UI

Two commands worth knowing for trusting output: cairn audit-provenance --min-tier T3 flags family-attribution hits resting on sandbox-memory evidence only, and cairn triage-gap surfaces high-detection samples the rules missed.

Details the summary omits

  • Rule inventory: 9 T1 / 8 T2 / 9 T3 = 26 total. 27 named acquisition channels (3 disabled), each a separate, independently-measured hypothesis.
  • More confirmed families than the summary lists: beyond PROMPTLOCK/LAMEHUG/PROMPTSTEAL/QUIETVAULT/CLOSEDQUORUM/FRUITSHELL, the repo also has reports for HONESTCUE, PROMPTFLUX, GUARDBREAKER (UAC-0099), and TEAMPCP (backdoored LiteLLM proxy). Families map to an A1–A8 archetype taxonomy; some span multiple (LAMEHUG A6/A7, QUIETVAULT A6+A8).
  • Reusable FP corpus: config/exclusions.yaml is a git-tracked blocklist of ~350 samples across ~25 product clusters, each with reason, reclassification, date, and analyst initials — so anyone running the same filters skips known-clean software without re-investigating it.

Caveats

The page states plainly that the metadata-only pipeline does attribution, but no family report is published on metadata evidence alone — every published attribution is first confirmed by hands-on Talos reverse engineering. Treat CAIRN's automated output as a lead generator, not a verdict; the audit-provenance command exists precisely because some hits rest on weaker (sandbox-memory-only) evidence.

Technologies named here

Techniques named here

  • Tiered YARA ontology
  • Scan text extraction / composed metadata matching
  • Embedding-based semantic clustering
  • Relationship graph construction
  • Pivoting on IOCs
  • Provenance auditing
  • Triage gap / high-detection sample surfacing
  • Seed-based rule validation
  • Cognitive artifact detection

Threat actors named here

Related in AI Security