Cisco Talos' CAIRN Toolkit Uncovers CLOSEDQUORUM, Windows Malware That Lets Four LLMs Vote as Its Command-and-Control

On 22 September 2026 Cisco Talos released CAIRN, an open-source toolkit for hunting AI-integrated malware, and detailed CLOSEDQUORUM, a 16.4 MB 64-bit Go Windows implant that polls DeepSeek, Qwen, Mistral, and Google Gemini to vote on stealing, injecting,…

Cisco Talos on 22 September 2026 published analysis of CLOSEDQUORUM, described as the first publicly documented autonomous AI-driven command-and-control implant and the first 'LLM-as-C2' architecture, alongside the release of CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit for hunting AI-integrated malware. CLOSEDQUORUM is a 16.4 MB, 64-bit Go-based Windows implant with no dedicated C2 server. It gathers host context and asks up to four commercial LLMs — DeepSeek, Qwen, Mistral, and Google Gemini — to vote via constrained JSON decisions on a fixed menu of actions (steal, inject, persist, or move), executing the majority choice with tie-breaking biased toward DeepSeek. Talos frames the design as 'effort displacement,' removing the need for continuous human operator input; WIRED characterized it as a shift from AI as a productivity tool to an operational component of attacks. The steal path dumps LSASS memory, harvests saved passwords from Chrome, Edge, and Firefox, collects MetaMask, Ethereum, and Exodus wallet data, and exfiltrates AES-256-GCM-encrypted results through a Discord webhook. Injection is via process hollowing or APC injection, and persistence uses WMI. Talos has not confirmed any in-the-wild deployment: the public sample is inert, containing placeholder API keys and a dummy webhook, while Security Affairs reports development builds embed real credentials and GBHackers says custom builds were likely intended for individual buyers, with artifacts linked to 2025 carding-forum posts. The Hacker News dates the code to at least 17 June 2026. Talos published detection material including Snort rule SID 1:66984, YARA logic, and six SHA-256 hashes, and recommends hunting for processes contacting multiple AI providers alongside LSASS access, injection activity, and WMI persistence. CAIRN itself uses a metadata-first approach, scoring 'cognitive artifacts' such as prompt templates, provider endpoints, API-key prefixes, libraries, and sandbox metadata through a three-layer ontology, analyzing sources like VirusTotal without downloading or executing binaries; Talos notes its clusters are investigative leads, not attribution. Help Net Security adds that the broader hunt was linked to LAMEHUG, which CERT-UA reported in July 2025 as an early AI-integrated malware sample. The ten reports are mutually consistent, with no factual disagreements.

• Announced 2026-09-22 by Cisco Talos; CLOSEDQUORUM described as the first reported autonomous AI-driven C2 implant and first 'LLM-as-C2' architecture.
• CLOSEDQUORUM is a 16.4 MB, 64-bit Go-based Windows implant with no dedicated C2 server (Help Net Security, CSO Online).
• Polls up to four commercial LLMs — DeepSeek, Qwen, Mistral, and Google Gemini — whose constrained JSON votes choose among steal, inject, persist, or move; the majority action is executed, with ties breaking toward DeepSeek.
• Steal path dumps LSASS, harvests Chrome/Edge/Firefox saved passwords, and collects MetaMask, Ethereum, and Exodus wallet data; exfiltration is AES-256-GCM encrypted via a Discord webhook.
• Injection techniques include process hollowing and APC injection; persistence is via WMI.
• Public build is nonfunctional (placeholder API keys, dummy webhook); Talos has not confirmed real-world use, though development builds reportedly embed real credentials and artifacts link to 2025 carding-forum posts.
• Code dates to at least 17 June 2026 (The Hacker News).
• Talos hunt linked artifacts to LAMEHUG, reported by CERT-UA in July 2025 as an early AI-integrated malware sample (Help Net Security).