A recent disclosure by Cisco Talos has unveiled a novel Windows implant known as CLOSEDQUORUM, which distinguishes itself from previously documented malware by entirely removing human operators from the tactical decision-making process. This innovative malware harnesses the capabilities of four commercial large language models (LLMs)—DeepSeek, Qwen, Mistral, and Google Gemini—allowing them to autonomously vote on the next course of action following its initial deployment.
The implications of this four-model voting structure are significant. Each LLM operates with its own safety guardrails, meaning that if one model declines a prompt for safety reasons, the remaining models can still proceed with the attack. This design creates a robust system that is resistant to the content filtering typically employed by AI companies, a feature that no single model possesses independently.
Inside the Voting Loop: How CLOSEDQUORUM Actually Works
CLOSEDQUORUM is a 16.4-megabyte executable compiled in Go, utilizing both Go and C code to make direct Windows system calls. Upon deployment, the implant conducts reconnaissance to gather essential system information, including hostname, OS architecture, CPU count, and Windows version. This data is then formatted into a structured prompt and sent sequentially to the four AI providers.
Each model receives identical prompts and a constrained set of options. The system prompt instructs the models to act as advanced malware strategists, providing only executable decisions. They must respond with a JSON object indicating one of four actions: steal, inject, persist, or move. Responses that do not conform to this schema are discarded. The ModelOrchestrator component tallies the votes and selects the action with the most votes, with ties resolved in favor of the model with the highest priority.
What “Steal” Actually Triggers — All Three Credential Stores at Once
When the AI panel decides to steal, CLOSEDQUORUM does not select among credential targets; instead, it simultaneously attacks three credential stores. It dumps LSASS memory to extract Windows domain and local account credentials, sweeps saved passwords from popular browsers, and retrieves cryptocurrency wallet data from various sources. The collected data is encrypted and sent to the operator’s Discord channel in manageable chunks, highlighting a sophisticated approach to data exfiltration.
Two Ways In: Process Injection Techniques
In the event of an inject decision, the implant employs one of two process injection techniques based on the model’s recommendation. The default method, Early Bird asynchronous procedure call (APC) injection, allows the implant to execute code before the main thread of a process fully initializes. Alternatively, if specified, it may utilize process hollowing to overwrite a suspended process’s entry-point region.
Three Overlapping Footholds for Persistence
The persist action establishes three overlapping mechanisms to ensure longevity within the target system. It writes a Registry Run key disguised as a WindowsUpdate entry, creates a scheduled task, and sets up a WMI event subscription that activates every 60 seconds. This multifaceted approach ensures that even if one mechanism is detected and removed, others may remain active.
How the Malware Hides from Security Tools
CLOSEDQUORUM employs several strategies to evade detection. Notably, it suppresses Event Tracing for Windows (ETW) telemetry by overwriting core logging functions, effectively blinding the operating system to its activities. Additionally, it introduces an initial delay before executing any actions, designed to outlast typical sandbox analysis environments.
LLM-as-C2: Why Blocking AI Provider Domains Is Not the Answer
This malware circumvents traditional command-and-control structures by calling API endpoints that are routinely accessed by legitimate enterprise applications. Blocking these domains would disrupt a significant portion of an organization’s AI tools, making it an impractical solution. Instead, Talos emphasizes the importance of behavioral detection strategies that focus on the combination of actions indicative of malicious activity.
The CAIRN Toolkit: Hunting AI-Integrated Malware at Scale
Alongside the disclosure of CLOSEDQUORUM, Talos introduced the CAIRN toolkit, designed for the detection of AI-integrated malware. This open-source tool operates solely on metadata, employing rule-based detection and semantic clustering to identify cognitive artifacts embedded within malware code. CAIRN aims to facilitate broader hunts for AI-integrated malware across various environments.
What Makes This Different From Prior AI-Assisted Malware
Unlike previous AI-assisted malware that merely enhanced human capabilities, CLOSEDQUORUM represents a significant shift by automating entire phases of an attack. Once deployed, the implant operates independently, executing decisions without the need for human oversight. This advancement highlights a new frontier in the evolution of malware, where the tactical decision-making loop is continuously active.
What Security Teams Should Do Right Now
Talos recommends that security teams prioritize detection strategies that focus on behavioral combinations indicative of CLOSEDQUORUM activity. Deploying the published YARA rule and utilizing the CAIRN toolkit can enhance the ability to identify and respond to this sophisticated threat effectively.
Frequently Asked Questions
What makes CLOSEDQUORUM different from other AI-assisted malware?
CLOSEDQUORUM uniquely removes the human operator from the tactical decision-making loop, allowing four LLMs to autonomously decide on actions post-deployment. This architecture enables continuous operation without human intervention.
Why can’t security teams just block access to DeepSeek, Mistral, and Gemini?
Blocking these domains would disrupt legitimate enterprise applications that rely on them, making it an ineffective strategy. Instead, security teams should focus on detecting behavioral combinations that indicate malicious activity.
Why does the four-model voting structure make AI safety guardrails less effective?
The voting structure allows the remaining models to proceed with an action even if one model declines due to safety concerns, creating a resilience against individual model limitations.
How can I detect CLOSEDQUORUM on a Windows system?
Utilizing the YARA detection rule published by Talos, which targets specific characteristics of the implant, can aid in identifying CLOSEDQUORUM. Additionally, the CAIRN toolkit provides a framework for broader detection efforts without requiring binary downloads.
