
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
10 stories, newest first · one card per story

Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.

Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.

Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.

Cisco Talos documents CLOSEDQUORUM, a Windows implant that votes across DeepSeek, Qwen, Mistral, and Gemini APIs to choose attack actions autonomously.

Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.

Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.

ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
Cisco Talos releases CAIRN to track AI malware and documents CLOSEDQUORUM, an unconfirmed Windows implant steered by LLMs.

Cisco Talos documents CLOSEDQUORUM, a Windows implant that lets commercial LLMs vote on its next action.
Today 1.6K readers · 2.4K views · 775 reads · all time 189K views