This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next
Cisco Talos documents CLOSEDQUORUM, a Windows implant that votes across DeepSeek, Qwen, Mistral, and Gemini APIs to choose attack actions autonomously.
Cisco Talos's CAIRN research project identified CLOSEDQUORUM, a Windows malware sample that replaces dedicated C2 by sending host details to up to four AI models—DeepSeek, Qwen, Mistral, and Gemini—and letting the majority vote select actions like credential theft, process injection, or persistence. The implant targets Windows and browser passwords plus cryptocurrency wallets, reports via a Discord webhook, and uses WMI-based persistence, though lateral movement has no working handler in the distributed build. The public build contains placeholder keys and a dummy reporting address, researchers did not observe it operating end to end, and there is no confirmed deployment in the wild. Development artifacts were linked to a carding forum user, but no victims or active campaign have been identified.
- Majority vote across DeepSeek, Qwen, Mistral, and Gemini decides each attack action.
- Targets Windows and browser passwords, crypto wallets; exfiltrates via Discord webhook.
- WMI persistence at C:\Windows\Temp\wmi.ps1; five developer-build SHA-256 hashes published.
- No confirmed in-the-wild deployment; placeholder keys indicate a design prototype.
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1003 OS Credential DumpingT1055 Process InjectionT1546.001 WMI Event SubscriptionT1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- Organizations
- Cisco TalosCLOSEDQUORUMDeepSeek
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.mistral.ai | rule; legitimate service, not malicious on its own. Domain api.mistral.ai AI-provider domain in the detection rule; legitimate servic |
| domain | openrouter.ai | rule; legitimate service, not malicious on its own. Domain openrouter.ai AI-routing domain in the detection rule; legitimate service |
| sha256 | 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 | s of compromise (IoCs):- Type Indicator Description SHA-256 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 Sample in the developer’s seven-day build chain. SHA-256 c4 |
| sha256 | 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb | a33adc17a63c Sample in the developer’s build chain. SHA-256 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb Sample in the developer’s build chain. SHA-256 eddbd0ecf719 |
| sha256 | c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f | 422dee5205a7 Sample in the developer’s build chain. SHA-256 c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f Sample in the developer’s build chain. SHA-256 f5f1f8c3e7b8 |
| sha256 | c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 | d7 Sample in the developer’s seven-day build chain. SHA-256 c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 Sample in the developer’s build chain. SHA-256 c13cea04f598 |
| sha256 | eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5 | de73c133f3cb Sample in the developer’s build chain. SHA-256 eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5 Sample in the developer’s build chain. Domain api.deepseek. |
| sha256 | f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c | 64e0b983a86f Sample in the developer’s build chain. SHA-256 f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c Sample in the developer’s build chain. SHA-256 5191cf625dfc |
From the original article
4 min read at cybersecuritynews.com
A Windows malware sample called CLOSEDQUORUM can choose its next move without waiting for an attacker to send instructions. Once configured and deployed, it asks AI models whether to steal data, hide in a process, or maintain access. The decision maker no longer needs a dedicated control server.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.