CAIRN
Named by 17 kept items in this workspace.
11 items name it under tools, 3 under classification.key entities, 2 under affected products and 1 under classification.technologies.
Search every workspace for CAIRN. It matches the name as written, so it can find other things that share it.
The items that name it 17
open source AI platform abused by threat actors
open-source AI problem-solving platform; about two dozen exposed, compromised instances found from around 2 October 2026
Cisco Talos metadata-first hunting toolkit (Cognitive Artifact Intelligence Research Network) that identifies AI-integrated malware from VirusTotal metadata without downloading binaries.
Cisco Talos' tracking/classification system for AI-related malware archetypes; used to classify 'A3: AI-Analysis Evasion' malware and track technique progression across samples.
Free research tool built by Cisco Talos to hunt for 'cognitive artifacts' (prompt templates, provider endpoints, API key prefixes, jailbreak wording) left in malware that calls out to AI; works from VirusTotal metadata without downloading or running samples, sorts findings into three tiers (AI strin
Penetration testing tool, repurposed in this campaign as part of an attack pipeline
New open-source research toolkit released by Talos to hunt, classify, and track emerging AI-integrated malware using a metadata-first methodology to identify cognitive artifacts (prompt templates, API keys, jailbreak terms) without reverse engineering the binary; includes YARA-based classification t
Open-source AI harness for autonomous exploitation used by the threat actor
Open source autonomous end-to-end penetration testing engine that takes target domains and an objective (e.g. shell or admin access) and runs until achieved, timed out, or stopped; used DeepSeek v4.1 Flash
Cisco Talos' open-source research toolkit for tracking AI-integrated malware; used to discover CLOSEDQUORUM
Research toolkit released by Cisco Talos for hunting, classifying, and tracking emerging AI-integrated malware using metadata-first analysis, without downloading or executing binaries
General-purpose problem-solving engine built on a Blackboard Architecture with an explicit fact-intent graph; validated on AI penetration testing, supports CTF solving, security assessment, and vulnerability research workflows
Research toolkit by Cisco Talos for identifying, attributing, and tracking AI-related artifacts embedded in malware, working exclusively from VirusTotal metadata (no binary downloads or detonation)
All technologies in this workspace.