New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
Cisco Talos analyzed ClosedQuorum, a Go Windows implant that asks Gemini, DeepSeek, Qwen, and Mistral to vote on steal, inject, persist, or move, with DeepSeek breaking ties. Steal simultaneously dumps LSASS, Chrome, Edge, and Firefox credentials, and MetaMask, Exodus, and Ethereum wallets, then sends results to a Discord webhook. Injection generates shellcode for process hollowing or Early Bird APC injection; the studied build has no lateral-movement handler. Talos reports no confirmed in-the-wild use, only placeholder API keys and a dummy webhook, and linked artifacts to 2025 carding-forum posts.
- Gemini, DeepSeek, Qwen, and Mistral vote; DeepSeek breaks ties.
- Steal path dumps LSASS, browsers, and cryptocurrency wallets to Discord.
- Injection uses generated shellcode via hollowing or Early Bird APC.
- No confirmed deployment; the sample used placeholder credentials.
Full article437 words · extracted from bleepingcomputer.com · click to collapse
A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack.
The Go-based malware acts with no commands from a human operator, using reconnaissance information and a voting system to decide its next step on infected hosts.
When votes are tied, DeepSeek has priority at making the final call, based on the option it considers most appropriate, followed by Qwen, Mistral, and Gemini.
Cisco Talos researchers analyzing ClosedQuorum say that the models are restricted to a predefined set of decisions, including:
- steal — simultaneously runs LSASS credential dumping, browser (Chrome, Edge, Firefox) credential theft, and cryptocurrency-wallet (MetaMast, Exodus, Ethereum) extraction
- inject — generates shellcode, then uses either process hollowing or Early Bird APC injection
- persist — executes the malware’s persistence module
- move — included as a possible lateral movement decision, but the analyzed distribution build has no corresponding handler, so it cannot execute this action
The stolen details are then passed to the operators via a Discord webhook, so apart from the malware delivery, the attack can be fully automated.
.jpg)
Source: Cisco
Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of AI models, commenting that this adds greater speed and scaling potential to malicious operations.
The researchers also highlight that this eliminates human interaction, allowing the attack chain to proceed at any time.
However, Cisco notes that this may also pose challenges in certain cases where rate limits are hit, output is malformed, or commercial APIs that the system relies on are temporarily unavailable.
Since it is not a sophisticated piece of malware, it is unclear if ClosedQuorum is a test or experiment. However, the researchers warn that it represents an "architectural shift towards attack-chain automation."
“While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025,” explains Cisco Talos.
The binary that Cisco Talos analyzed contains placeholder API credentials and a dummy Discord webhook, although the creators can add those in their custom ClosedQuorum builds.
Cisco Talos discovered ClosedQuorum through CAIRN, an open-source toolkit it released to help researchers track and analyze AI-integrated malware.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.