RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
55
Organization
Google Gemini
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 22, 2026
- Last mentionedSep 29, 2026
Timeline
3 articles · newest firstAI malware just removed the human from the attack loop
Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
62
Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
60
Appears with
- CLOSEDQUORUMorganization · 2
- Mistralai model · 2
- DeepSeekorganization · 2
- Qwenai model · 2
- Cisco Talosorganization · 2
- Cleafyorganization · 1
- CAIRNorganization · 1
- Panda Workshoporganization · 1
- BlackCatthreat actor · 1
- RatHatorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.