An AI-driven implant that makes its own tactical decisions. A Chinese threat actor exploiting network switches across a thousand devices. A hypervisor boundary broken on ARM64. Monday’s stories share a common thread: the assumptions defenders rely on - human-operated C2, patched infrastructure, hypervisor isolation - are each being tested in production right now.

In the News

Talos Discovers CLOSEDQUORUM - the First Autonomous AI C2 Implant in the Wild

Cisco Talos published analysis of CLOSEDQUORUM, the first documented command-and-control implant that uses artificial intelligence to make tactical decisions without human operator involvement. The implant embeds a local language model and uses prompt-driven decision trees to autonomously select targets, time lateral movement, and stage exfiltration based on the host environment it lands in.

This is not AI-assisted tooling where a human operator queries a model for reconnaissance help. CLOSEDQUORUM removes the human from the loop entirely. The implant evaluates the compromised environment - installed software, network topology indicators, credential material available - and makes its own decisions about next steps. Traditional C2 detection models that rely on fixed beacon intervals, predictable command structures, or known infrastructure patterns are structurally unprepared for this.

Alongside the disclosure, Talos released CAIRN, an open-source toolkit designed for hunting AI-integrated malware. CAIRN identifies cognitive artifacts - embedded prompts, API keys, jailbreak strings, and model configuration files - in memory dumps and on disk. SOC teams should pull down CAIRN this week and run it against baseline memory captures. The detection paradigm for AI-augmented threats starts with knowing what cognitive artifacts look like in your environment before an implant introduces them.

What defenders should do: Deploy behavioral analytics and anomaly-based detection that does not depend on static C2 signatures. Download and operationalize the CAIRN toolkit for hunting AI artifacts in memory. Review endpoint telemetry for processes loading local ML model files or making inference API calls from unexpected contexts. MITRE ATT&CK: T1071 (Application Layer Protocol), T1059 (Command and Scripting Interpreter).

Chinese Threat Actor Exploits ZyXEL GS1900 Switch Vulnerability - ~1,000 Devices Compromised

A Chinese threat actor is actively exploiting CVE-2026-7273, a stack-based buffer overflow (CVSS 8.8) in ZyXEL GS1900 series managed switches, to exfiltrate data from approximately 1,000 compromised devices. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog and set a federal remediation deadline of September 25.

The vulnerability requires network adjacency but no authentication. In practice, this means any attacker with layer-2 access to the management VLAN of an affected switch - whether through a compromised host on the same segment or a misconfigured network - can trigger the overflow and execute arbitrary code. Branch offices and small data centers running GS1900 switches as edge or access-layer infrastructure are the primary risk surface.

The exploitation campaign is attributed to a Chinese state-aligned threat actor, though the specific group name has not been disclosed in public reporting as of this writing. The data exfiltration component suggests the compromised switches are being used as network-level collection points - intercepting traffic transiting the switch rather than using the switch as a pivot to other systems.

What defenders should do: Patch ZyXEL GS1900 firmware immediately. If patching is not possible by the CISA deadline, segment affected switches so their management interfaces are unreachable from general-purpose VLANs. Audit asset inventory for ZyXEL switching infrastructure that may not be centrally managed. Monitor for unusual outbound traffic volumes from switch management IPs. MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1040 (Network Sniffing).

Linux Kernel ARM64 KVM Flaw Enables VM Escape - CVE-2026-89775

CVE-2026-89775 is a use-after-free vulnerability in the Linux kernel’s KVM hypervisor implementation on ARM64 systems with nested virtualization enabled. A freed host memory page remains mapped into the guest’s address space, giving a malicious virtual machine read-write access to host memory. Researchers confirmed this as a weaponizable VM escape vector.

The scope is significant. Cloud providers running ARM64 hypervisors - AWS Graviton instances, Ampere Altra-based infrastructure, and on-premises ARM64 virtualization deployments - are all potentially affected when nested virtualization is enabled. Patches are available in the upstream kernel, but the lag between upstream availability and distribution kernel adoption means many production systems will remain unpatched for weeks.

What defenders should do: Apply upstream kernel patches. If patching is delayed, disable nested virtualization on ARM64 KVM hosts where it is not operationally required. Deploy microsegmentation at the workload level so that a compromised VM that escapes to the host cannot reach other workloads. Verify with cloud providers whether your specific instance types have been patched. MITRE ATT&CK: T1611 (Escape to Host).

Fake LastPass Installer Uses Microsoft-Signed Kernel Driver to Kill 145 EDR Products

A trojanized LastPass Authenticator installer hosted on GitHub deploys a kernel driver - signed through Microsoft’s Hardware Compatibility Program - that terminates 145 security products before dropping the Rapuncel infostealer. The driver had zero VirusTotal detections at the time of discovery.

This campaign represents an evolution beyond traditional Bring Your Own Vulnerable Driver (BYOVD) attacks. Instead of loading a known vulnerable but legitimately signed driver and exploiting it, the attackers obtained a fresh, purpose-built malicious driver through Microsoft’s own signing pipeline. The driver is not vulnerable - it is intentionally malicious, and it carries a valid Microsoft signature. This defeats controls that rely on blocking unsigned or known-vulnerable drivers.

LastPass and Delphos Labs published joint analysis confirming the campaign’s scope and providing indicators. The attack chain starts with SEO poisoning and GitHub repository manipulation to direct victims to the trojanized installer.

What defenders should do: Ensure endpoint agents have kernel-level tamper protection enabled. Monitor for driver load events (Sysmon Event ID 6) involving recently signed drivers from unexpected publishers. Implement application allowlisting that restricts which kernel drivers can load, regardless of signature status. Alert on endpoint telemetry gaps - if a host goes silent, treat the silence as a detection signal. MITRE ATT&CK: T1562.001 (Impair Defenses: Disable or Modify Tools), T1068 (Exploitation for Privilege Escalation).

Defender Action Items

  • ZyXEL GS1900 switches: Patch CVE-2026-7273 by September 25 or isolate management interfaces on a restricted VLAN immediately. Audit asset inventory for unmanaged ZyXEL infrastructure.
  • ARM64 KVM hosts: Apply upstream kernel patch for CVE-2026-89775. Disable nested virtualization where not required. Confirm cloud provider patching status for Graviton and Ampere instances.
  • CAIRN toolkit deployment: Download CAIRN from Talos and run against baseline memory captures to establish cognitive artifact baselines before an AI-integrated implant introduces them.
  • EDR tamper protection: Verify kernel-level self-protection is enabled on all endpoint agents. Create alerting rules for Sysmon Event ID 6 (driver loaded) with recently issued signatures. Alert on endpoint telemetry silence.
  • SharePoint Server: Patch CVE-2026-65660 - the CVSS 6.5 score undersells the actual authenticated RCE impact. Review SharePoint access controls and restrict authenticated user permissions.
  • WordPress: Update to v7.1.1 to remediate Comment2Shell (CVE-2026-93485) - anonymous XSS in comments chains to RCE when an admin views the page.

Detection Queries

The following Splunk SPL query detects driver load events from recently signed certificates, which is relevant to the fake LastPass BYOVD campaign. It looks for Sysmon Event ID 6 (driver loaded) where the signature date is within the last 30 days and the signing authority is not in your known-good list.

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
| eval sign_date=strptime(SignatureDate, "%Y-%m-%d")
| where sign_date > relative_time(now(), "-30d")
| search NOT [| inputlookup approved_driver_signers.csv | fields SignerName]
| stats count by ImageLoaded, Signed, SignatureStatus, SignerName, Computer
| where count < 5
| sort - count

This query flags recently signed drivers that are not on your approved list and have loaded on fewer than 5 hosts - a high-fidelity indicator of a novel, potentially malicious driver being introduced into your environment. Adjust the 30-day window and host-count threshold to match your environment’s baseline. False positive rate is low in environments with a well-maintained approved_driver_signers.csv lookup.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.