A look at a new LLM-operated Windows implant, what it leaves behind, and how to investigate it.
By the Container 7 Team
Most implants wait for an operator to send commands. Iris, also tracked as C2Agent, waits for a goal. The operator types something like "get the administrator's password" and an AI model takes it from there, choosing each command, reading the output and deciding what to do next. If you defend Windows endpoints in an organization that uses AI tools, this one's worth your time.
What's happening
Iris is a Windows implant written in Go. It was first seen on September 10, 2026, and Palo Alto Networks' Unit 42 documented it in October 2026.
Its design is unusual. The operator doesn't send a script or a list of commands. They send a plain-language objective, and the implant hands interactive control of the host to a large language model (LLM). The model works in a loop. It runs a command, reads the result and picks the next step.
The family has moved fast. Unit 42 tracked 32 samples across eight major versions in 29 days. Newer versions can hijack AI developer tools already installed on the victim's machine and abuse legitimate commercial AI services to carry out their work. Unit 42 also describes it as the first documented implant to act as a Model Context Protocol (MCP) client, which lets it add new tool connections at runtime.
Why it matters
Iris changes two things defenders rely on.
First, there's no fixed playbook. A traditional implant repeats the same tasks in the same order, which gives you a pattern to detect. With a model in control, the sequence of commands can shift from one run to the next, even when the goal stays the same.
Second, it hides in traffic you've probably already approved. Most organizations allow AI services out of the network because their developers and analysts use them every day. When the malware calls those same services, or drives an AI tool that's already installed, malicious requests sit next to legitimate ones. Your AI egress policy now affects how much you can see.
There's also an upside for defenders. A model that reasons step by step can leave a record of that reasoning. If you can find it, you can see what the attacker asked for and what the model tried to do.
What to look for
No single signature covers every version, so hunt for behavior. Start with these questions:
- Process lineage: Are AI developer tools or command-line assistants being launched by unexpected parent processes, or running commands nobody on the team asked for?
- AI egress: Which hosts talk to commercial AI services, and do those hosts have a business reason to? Look for AI traffic from servers or accounts that don't normally use it.
- Command cadence: Look for bursts of reconnaissance and credential-access commands with short, regular gaps between them, as if each one waited for the last result.
- On-disk artifacts: Watch for new configuration, prompt or "skill" files appearing alongside unfamiliar binaries in user-writable folders.
- Recorded reasoning: Where you can find the model's output, compare what it planned with what the host logs say actually ran.
Get hands-on
The Iris C2Agent Log Analysis lab puts you in the defender's seat. Working in Elastic, you'll investigate a Windows host where Iris was executed and tasked by a remote operator. You'll recover the artifacts it left on disk and on the network, then read the model's own recorded reasoning to separate what the attacker intended from what actually happened on the host. By the end, you'll know the indicators of compromise (IOCs) this family leaves behind.
The lab is built for security analysts, incident responders, threat hunters, and detection engineers who monitor Windows estates. It also suits anyone working out how allowing AI traffic changes their attack surface.
It's the first of our releases on Iris. A Cyber Range Exercise is in the works, so watch this space.
Start the lab: http://immersivelabs.online/labs/hunting-the-tools-iris-c2agent-log-analysis
Community Manager