Talos details CLOSEDQUORUM, first reported autonomous AI-powered C2

💥 BREACHES & INCIDENTS

• Virgin Active Warns Customers After RelyComply Cyber Incident Exposes Payment Data
  Virgin Active South Africa is notifying customers that personal and payment transaction data held by third-party provider RelyComply may have been exposed in a cyber incident claimed by the Direwolf group.
  • Affects Virgin Active South Africa members whose payment transactions appeared in transaction-monitoring data held by RelyComply, a third-party service provider.
  • Exposed data includes personal and payment transaction information for transactions between May 7 and September 9, 2026; full card numbers and banking credentials were not shared with RelyComply.
  • RelyComply detected unauthorized access possibly starting around September 2, 2026, and notified Peach Payments on September 8; Virgin Active was formally notified on September 15.
  • The threat actor group calling itself 'Direwolf' has publicly claimed responsibility; scope of data access is still under investigation.
  • Incident reference: SC20263251.
  Sources 📄 Source: relycomply.com · 📎 Coverage: thehackerwire.com · 👁 via thehackerwire.com (discovered)

🕵️ RESEARCH & DEEP DIVES

• Talos details CLOSEDQUORUM, first reported autonomous AI-powered C2 implant
  Cisco Talos has documented CLOSEDQUORUM, a Windows implant that uses commercial LLMs as its C2 to autonomously decide and execute actions.

  • CLOSEDQUORUM is a 16.4MB 64-bit Go Windows implant discovered via Talos' CAIRN project; no confirmed in-the-wild deployment
  • Targets user credentials and crypto wallets
  • Uses up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Google Gemini) as C2, voting on the next action via plurality voting
  • Requires no human operator or attacker-operated C2 server; public build contains placeholder API keys and a dummy webhook
  • Developer linked to criminal forum postings related to carding dating back to 2025
  Sources 📎 Coverage: blog.talosintelligence.com · 👁 via Cisco Talos

• Cisco Talos releases CAIRN toolkit for hunting and tracking AI-integrated malware
  Cisco Talos has released CAIRN, an open research toolkit for hunting, classifying, and tracking AI-integrated malware.

  • CAIRN (Cognitive Artifact Intelligence Research Network) targets malware that operationalizes, targets, or exploits AI systems, including LLM-integrated families like LAMEHUG tracked since July 2025.
  • It works metadata-first: no binary downloads or execution needed, extracting cognitive artifacts such as embedded prompts, provider endpoints (api.openai.com, api.anthropic.com, api.deepseek.com), API key prefixes, and AI-analysis evasion strings.
  • Up to 24 acquisition filters scan strings, sandbox behavior, and AV labels; filters include python-ai-scripts (langchain, litellm), local-llm-runtime (ollama, llama.cpp, gguf), and agentic-tooling detection.
  • Samples are stored in a SQLite corpus with automatic YARA scanning and a three-tier ontology (primitive artifacts, behavioral context, operational families), plus a graph explorer for pivoting across related malware and infrastructure.
  • Initial findings include CLOSEDQUORUM, the first reported autonomous AI C2 implant; the toolkit is available on GitHub.
  Sources 📄 Source: github.com · 📎 Coverage: blog.talosintelligence.com · 👁 via Cisco Talos

• Threat actor abuses GitHub Codespaces to spin up free Windows RDP boxes
  Kevin Beaumont reports a threat actor abusing GitHub Codespaces to run free Windows 11 desktops accessible via RDP.

  • Applies to GitHub Free users, who can create Codespaces with up to 32-core CPUs and 1.2 TB of bandwidth at no cost and without card payment details or KYC checks
  • The ItzLevvie/dind repository provides tooling to run Windows 11 inside GitHub Codespaces, based on the dockur/windows project
  • Access is via RDP through Tailscale, chosen over Ngrok for remote connectivity
  • Codespaces usage in the example is billed to the microsoft organization, with machine types up to 32 cores and 128 GB RAM
  Sources 📄 Source: github.com · 📎 Coverage: cyberplace.social · 👁 via @GossiTheDog@cyberplace.social

• BambooToken Linux backdoor uses MQTT C2 to run shell commands and exfiltrate files
  A newly analysed Linux backdoor named BambooToken uses MQTT as its command-and-control channel to execute shell commands and exfiltrate files.

  • Targets Linux systems; the sample includes a host inventory collector, command worker, and file manager connected via encoded MQTT topics.
  • Connects to an MQTT broker over TCP port 2883 using a 59-byte embedded config blob, a fixed group topic, and a UUID-like client ID; retries every 15 seconds.
  • Hides payloads and topic labels with repeating XOR encoding; shell requests run via /bin/sh -c and file transfers use 128-KiB chunks split from JSON by a NUL byte, with a misspelled 'flies' field in directory listings.
  • Collects username, hostname, OS release, machine ID (via /etc/machine-id or fallback /var/lib/myapp), network and process details; initial access, operator, and victim campaigns are not established.
  • IOCs include SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926, broker live-hk[.]c2iznja[.]com (202.144.192[.]149), TCP/2883, and group topic {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Iranopasmigirim campaign targeted Iranian dissidents with ParsaStealer infostealer
  InfoGuard Labs uncovered a June 2026 espionage campaign targeting Iranian dissidents that deployed the ParsaStealer infostealer.

  • Targets Iranian experts and activists outside Iran, lured via a fake PDF invitation tied to the 'Rise Iran' campaign linked to Prince Reza Pahlavi.
  • Payload is ParsaStealer (umpdc.dll), a Rust-based infostealer evolved from an earlier Go version, ReaperStealer, that steals Chromium credentials using Chrome App-Bound Encryption decryption.
  • Delivery chain starts with an LNK file that uses curl to download a decoy PDF, a legitimate signed RuntimeBroker.exe, and the malicious umpdc.dll, which executes via DLL sideloading.
  • Exfiltrated data is sent to Telegram; later samples used pcalua.exe to launch cmd.exe or powershell.exe for evasion, and hosting shifted from GitHub to tmpfiles.org and curl-t.com.
  • OpSec failures exposed operator details: commits from sudo3r@proton.me with Iran timezone +0330, Telegram bot reap3rdatabot, and hostname/user 'parsa'.
  Sources 📎 Coverage: labs.infoguard.ch · 👁 via @campuscodi@mastodon.social

📋 ADVISORIES

• 📄 Source for D-Link warns of max-severity unpatched zero-day in DIR-822A routers (CVE-2026-86296) — nvd.nist.gov

🔓 CVEs & KEV

• CVE-2026-74849 — Zohocorp ManageEngine ADSelfService Plus — CVSS 9.8 — Remote code execution vulnerabilityZohocorp ManageEngine ADSelfService Plus v...

• CVE-2026-89775 — Linux — CVSS 9.3 — New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

• CVE-2026-65660 — Microsoft Sharepoint Server — CVSS 8.8 — SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

• CVE-2026-63278 — The Document Foundation LibreOffice — CVSS 6.7 — Package URLs can be used to exfiltrate arbitrary INI file values and environm...