Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
Cisco Talos discovered CLOSEDQUORUM, a Go-based Windows implant that queries Google Gemini, DeepSeek, Qwen, and Mistral whose majority vote selects predefined actions, with DeepSeek breaking ties. Its modules dump LSASS memory, steal Chrome/Edge/Firefox passwords and MetaMask/Exodus/Ethereum wallet data, inject shellcode via process hollowing or Early Bird, and establish WMI persistence, exfiltrating AES-256-GCM encrypted data to operator Discord webhooks. No in-the-wild deployment has been observed, but artifacts link the developer to 2025 carding forum posts. Talos also open-sourced its CAIRN toolkit for hunting AI-integrated malware.
- First publicly documented Windows implant using an LLM quorum for C2 decisions
- Four models vote; DeepSeek takes precedence on ties, then Qwen, Mistral, Gemini
- Modules dump LSASS, steal browser passwords and MetaMask/Exodus wallets, inject, persist
- Stolen data AES-256-GCM encrypted, sent to operator Discord webhook with rotating key
- Detect processes contacting multiple LLM APIs plus LSASS access, injection, WMI persistence
- ATT&CK
- T1003.001 OS Credential Dumping: LSASS MemoryT1555.003 Credentials from Password Stores: Credentials from Web BrowsersT1055.012 Process Injection: Process HollowingT1546.003 Event Triggered Execution: WMI Event SubscriptionT1041 Exfiltration Over C2 Channel
- Organizations
- Cisco TalosCLOSEDQUORUMDeepSeekGoogle Gemini
From the original article
2 min read at theregister.com'first' publicly documented Windows implant to use LLMs for C2
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.