A recent disclosure from Cisco Talos has unveiled a groundbreaking Windows implant known as CLOSEDQUORUM, which distinguishes itself by completely removing human decision-making from the tactical execution of cyberattacks. This innovative malware employs a panel of four advanced commercial large language models—DeepSeek, Qwen, Mistral, and Google Gemini—to autonomously determine the next steps in an attack, executing the chosen action without any further human intervention post-deployment.
Inside the Voting Loop: How CLOSEDQUORUM Actually Works
CLOSEDQUORUM is a 16.4-megabyte executable compiled in Go, combining both Go and C code to interact directly with Windows systems. Upon deployment, the implant conducts an initial reconnaissance to gather critical system information such as hostname, OS architecture, CPU count, Windows version, and administrator privileges. This data is then formatted into a structured prompt and sent sequentially to each of the four AI models.
Each model receives identical prompts and a limited set of options, with the system prompt instructing them to act as “advanced malware strategists” and provide only executable decisions. The models must respond with a JSON object indicating one of four potential actions: steal, inject, persist, or move. Any responses that do not conform to this schema are discarded.
The ModelOrchestrator component tallies the votes through a function called interModelDiscussion(), selecting the action with the most votes. In the event of a tie, the model with the highest priority—DeepSeek—casts the deciding vote. If all models refuse to act, the implant enters a sleep-and-retry loop, ensuring that the decision-making process remains uninterrupted.
What “Steal” Actually Triggers — All Three Credential Stores at Once
When the panel votes to steal, CLOSEDQUORUM simultaneously targets three credential stores. It dumps LSASS memory using MiniDumpWriteDump with SeDebugPrivilege enabled, extracting Windows domain and local account credentials. Concurrently, it retrieves saved passwords from popular browsers like Chrome, Edge, and Firefox, as well as cryptocurrency wallet data from MetaMask and Exodus.
All collected data is encrypted using an AES-256-GCM date-derived key, then base64-encoded and sent to the operator’s Discord channel in 1,900-byte segments at one-second intervals. This method of encryption allows the developer to potentially decrypt any stolen data, highlighting a level of obfuscation rather than true confidentiality.
Two Ways In: Process Injection Techniques
When the quorum opts for inject, the implant chooses between two process injection techniques based on the model’s response. The default method is Early Bird asynchronous procedure call (APC) injection, which allows the implant to execute before the main thread of a suspended Windows process fully initializes. Alternatively, if specified, the implant can utilize process hollowing, overwriting the entry-point region of a suspended process.
Three Overlapping Footholds for Persistence
The persist action establishes three overlapping mechanisms to ensure the implant’s longevity, each designed to withstand various defensive measures. A Registry Run key is created under the current user’s profile, masquerading as a legitimate WindowsUpdate entry. Additionally, a scheduled task is set up via schtasks.exe, and a permanent WMI event subscription is established through a PowerShell script, ensuring that even if one mechanism is removed, others remain active.
How the Malware Hides from Security Tools
CLOSEDQUORUM employs several techniques to evade detection. One notable method involves suppressing Event Tracing for Windows (ETW) telemetry by overwriting the EtwEventWrite function, effectively disabling the operating system’s logging capabilities during its operation. An initial delay of five minutes precedes any activity, allowing it to circumvent short-window sandbox analyses that typically run for only a few minutes.
LLM-as-C2: Why Blocking AI Provider Domains Is Not the Answer
Unlike traditional command-and-control architectures that rely on identifiable server infrastructure, CLOSEDQUORUM connects to API endpoints used by numerous legitimate enterprise applications daily. Blocking these domains would disrupt essential AI tooling within organizations, making behavioral combination detection a more effective strategy. Talos recommends treating any Windows process that simultaneously accesses multiple LLM provider APIs while engaging in suspicious activities as a high-confidence threat indicator.
The CAIRN Toolkit: Hunting AI-Integrated Malware at Scale
Alongside the CLOSEDQUORUM disclosure, Talos introduced the CAIRN toolkit, designed to detect AI-integrated malware without executing binaries. This toolkit utilizes metadata-based analysis to identify cognitive artifacts—embedded prompts, provider endpoints, and other indicators within malware code—allowing for comprehensive detection across various environments.
What Makes This Different From Prior AI-Assisted Malware
Prior research primarily focused on enhancing human attackers’ capabilities, allowing them to generate phishing lures or malicious code more efficiently. In contrast, CLOSEDQUORUM represents a significant shift by transferring an entire phase of the attack from human operators to the system itself. Once deployed, the implant autonomously executes its tactical decision-making loop, independent of human oversight.
What Security Teams Should Do Right Now
To counteract the threats posed by CLOSEDQUORUM, Talos recommends that security teams:
- Prioritize behavioral combination detection strategies, flagging processes that contact multiple LLM provider APIs while triggering suspicious activities.
- Implement the published YARA rule targeting the implant’s hardcoded system prompt and associated behaviors.
- Avoid wholesale blocking of AI provider domains to prevent disruption of legitimate enterprise applications.
Frequently Asked Questions
What makes CLOSEDQUORUM different from other AI-assisted malware?
CLOSEDQUORUM uniquely removes the human element from one phase of the attack, allowing four AI models to autonomously decide and execute actions without human command.
Why can’t security teams just block access to DeepSeek, Mistral, and Gemini?
Blocking these endpoints would disrupt legitimate enterprise applications that rely on them, making it an ineffective strategy. Instead, behavioral combination detection is recommended.
Why does the four-model voting structure make AI safety guardrails less effective?
The voting structure allows a plurality of models to override a single model’s refusal, making it more resilient against individual content filtering measures.
How can I detect CLOSEDQUORUM on a Windows system?
Utilize the YARA detection rule published by Talos, which targets specific characteristics of the implant, alongside the CAIRN toolkit for broader analysis.