New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
Cisco Talos analyzed ClosedQuorum, a Go Windows implant that asks Gemini, DeepSeek, Qwen, and Mistral to vote on steal, inject, persist, or move, with DeepSeek breaking ties. Steal simultaneously dumps LSASS, Chrome, Edge, and Firefox credentials, and MetaMask, Exodus, and Ethereum wallets, then sends results to a Discord webhook. Injection generates shellcode for process hollowing or Early Bird APC injection; the studied build has no lateral-movement handler. Talos reports no confirmed in-the-wild use, only placeholder API keys and a dummy webhook, and linked artifacts to 2025 carding-forum posts.
- Gemini, DeepSeek, Qwen, and Mistral vote; DeepSeek breaks ties.
- Steal path dumps LSASS, browsers, and cryptocurrency wallets to Discord.
- Injection uses generated shellcode via hollowing or Early Bird APC.
- No confirmed deployment; the sample used placeholder credentials.
- ATT&CK
- T1003.001 LSASS MemoryT1555.003 Credentials from Web BrowsersT1005 Data from Local SystemT1055.012 Process HollowingT1055.004 Asynchronous Procedure Call
- Malware
- ClosedQuorum
- Organizations
- Cisco Talos
From the original article
2 min read at bleepingcomputer.com
A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.