CLOSEDQUORUM and the Rise of Autonomous AI Malware

Cisco Talos has documented CLOSEDQUORUM, a Windows malware sample that shifts part of the command-and-control function from a human operator to a panel of commercial large language models (LLMs). Rather than waiting for commands from a dedicated attacker-controlled server, the implant gathers host information, submits structured requests to as many as four model providers, and executes the action selected through a voting process.

The finding is significant because it demonstrates a different use of artificial intelligence in offensive tooling. Earlier AI-assisted operations generally made human attackers faster: they helped generate lures, code, or analysis. CLOSEDQUORUM instead attempts to remove the operator from a bounded tactical phase. Talos describes this as effort displacement—transferring operational decisions to the malware and its model-driven logic.

There is an important qualification. Talos has not confirmed that CLOSEDQUORUM was deployed in the wild. The publicly observed distribution binary contains placeholder LLM credentials and a dummy Discord webhook, making that build non-functional as distributed. Static analysis and development-build evidence nevertheless reveal the intended architecture and capabilities. Artifacts from the binary also connected its developer to criminal-forum postings related to carding dating back to 2025, but the research does not establish a confirmed victim set or a completed campaign.

How the autonomous C2 model works

CLOSEDQUORUM is a 16.4 MB, 64-bit Windows executable compiled in Go, with Go and C components used for direct Windows system calls. Its distinctive feature is the treatment of commercial AI services as the decision layer of the C2 system.

The implant can be configured to query DeepSeek, Qwen, Mistral, and Google Gemini. It contacts the providers sequentially through a component Talos identified as ModelOrchestrator. Each model receives a constrained prompt containing information about the host and the current target process. The expected response is structured JSON rather than unrestricted text.

The model is asked to select from a limited decision vocabulary. The available actions identified by Talos are inject, persist, steal, and move. Responses are collected and resolved by plurality vote. If there is a tie, the implementation favors providers in a fixed order, with DeepSeek first, followed by Qwen, Mistral, and Gemini. If all providers fail, the implant uses a fallback value that does not map to a capability handler; it sleeps and retries instead of taking a default action.

This design creates resilience against an individual provider refusing a request, timing out, or returning malformed data. It does not make the system infallible. Rate limits, provider behavior, invalid output, missing credentials, and API availability can all interrupt the decision loop. Those dependencies are weaknesses as well as operating requirements.

The implant sends the selected action and the model reasoning to an operator-controlled Discord webhook. Talos says the telemetry can include the winning decision, target process, exploit type, evasion method, payload configuration, model, and timestamp. The public build uses a dummy webhook, while development-build evidence indicates that operators could receive customized binaries with API credentials and webhook details inserted at compile time.

Capabilities exposed by the sample

The decision language is narrow, but the associated handlers cover several high-impact actions. A steal decision invokes three collection functions together: LSASS credential dumping, browser credential theft, and cryptocurrency-wallet extraction.

• Windows credentials: Talos observed code that enables SeDebugPrivilege and uses MiniDumpWriteDump to capture LSASS memory.
• Browser data: The implant targets Chrome and Edge Login Data and Firefox logins.json files.
• Wallet information: The sample searches for MetaMask data in a Chrome extension profile, Exodus wallet material, and Ethereum wallet data.
• Process injection: The inject branch can generate shellcode and use either Early Bird APC injection or process hollowing, depending on the selected option.
• Persistence: The sample includes Registry Run key, scheduled-task, and permanent WMI event-subscription mechanisms.

Talos mapped the observed behaviors to several MITRE ATT&CK techniques. The injection paths correspond to T1055.004, Asynchronous Procedure Call, and T1055.012, Process Hollowing. Persistence includes T1547.001 for Registry Run Keys / Startup Folder, T1053.005 for Scheduled Task/Job, and T1546.003 for WMI Event Subscription.

The WMI mechanism writes a PowerShell script to a path consistent with C:\Windows\Temp\wmi.ps1 and executes it with powershell.exe. The implementation also creates a system-performance query that triggers every 60 seconds. These behaviors can leave valuable forensic evidence even when the malware attempts to blend into normal Windows activity.

Collection, staging, and exfiltration

Talos reports that collected material is staged under C:\Windows\Temp\ before transmission. The data is encrypted with AES-256-GCM, using a key derived from the current date, then Base64-encoded. Ciphertext is divided into 1,900-byte segments and posted to a Discord webhook at one-second intervals.

This encryption protects the content during transfer but does not provide strong separation between the malware developer and operator. Because the key is derived from the date, Talos assesses that the developer could theoretically decrypt an operator’s exfiltrated material if the date is known. The report characterizes this as obfuscation rather than true confidentiality separation.

The sample also attempts to reduce visibility. Talos observed code that overwrites EtwEventWrite with a return instruction, suppressing a source of Event Tracing for Windows telemetry. A secondary payload is encrypted, with decryption tied to system time. The implant introduces an initial five-minute delay and then polls at randomized intervals between five and 15 minutes, behavior intended to reduce exposure to short-lived sandbox runs.

Windows Update-themed names, consumer application references, and familiar system locations are used to make activity less conspicuous. These masquerading choices should not be treated as proof of compromise by themselves; their value increases when combined with process, network, and credential-access signals.

What defenders can observe

Talos recommends prioritizing behavioral correlation over simple domain blocking. Legitimate software may contact a single AI provider or Discord. A much rarer pattern is one Windows executable contacting several model providers, accessing LSASS, injecting into a suspended process, creating WMI persistence, and posting to Discord.

Potential network observations include connections to provider infrastructure such as api.deepseek[.]com, api.mistral[.]ai, and openrouter[.]ai, together with Discord-related traffic such as cdn[.]discordapp[.]com. These are not standalone indicators of compromise. Organizations should avoid blocking legitimate services solely because they appear in the research; instead, investigate unusual combinations, process ancestry, timing, and account context.

Host-based hunting should look for:

• Unexpected executables making API requests to multiple LLM providers in a short period.
• Structured requests containing host details or offensive capability terms, where TLS inspection or provider-side telemetry makes that content visible and lawful.
• LSASS access from software that does not normally perform credential-management functions.
• Suspended-process creation followed by memory writes, APC queuing, or image-entry-point replacement.
• New Registry Run values, scheduled tasks, or permanent WMI subscriptions associated with unusual binaries.
• PowerShell execution involving a script under C:\Windows\Temp\.
• Repeated five-to-15-minute execution intervals, particularly after an initial delay.
• Discord webhook communication from a process that also accesses credential stores or stages files in temporary directories.

Talos also published six SHA-256 values representing the developer’s build chain over seven days. They include 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7, c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7, c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f, f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c, 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb, and eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5. Because the research describes these as development-build hashes, they should supplement—not replace—behavioral detection.

What organizations should do now

1. Correlate AI-service traffic with endpoint behavior. Alert when an unusual Windows process contacts multiple model providers and also performs LSASS access, process injection, persistence creation, or Discord communication.
2. Protect credential stores. Review controls around LSASS, browser password databases, wallet directories, and sensitive temporary files. Investigate unexpected access rather than relying only on malware signatures.
3. Monitor persistence locations. Audit new Run key values, scheduled tasks, and permanent WMI subscriptions. Pay particular attention to Windows Update-themed names and scripts launched from temporary directories.
4. Strengthen endpoint telemetry. Preserve process creation, memory-access, PowerShell, WMI, Registry, and network events. Where appropriate, assess whether ETW tampering or other telemetry-suppression behavior is being detected.
5. Use the supplied indicators carefully. Search the six hashes and Talos’s published YARA rule within appropriate malware-analysis and endpoint workflows, while accounting for customized operator builds that may not match the public samples.
6. Review egress policy. Define which systems may use commercial AI APIs and Discord. Unexpected access from servers, administrative workstations, or unsigned binaries should receive additional scrutiny.
7. Prepare for credential exposure. If evidence of LSASS, browser, or wallet theft exists, follow incident-response procedures for assessing and rotating affected credentials and tokens.

Conclusion

CLOSEDQUORUM is not evidence that autonomous malware has become universally capable, and Talos has not confirmed an in-the-wild deployment. It is nevertheless a concrete example of how structured model output can be connected directly to attack logic. Its reliance on commercial APIs, constrained decisions, deterministic voting, and conventional Windows techniques creates both operational limitations and detectable signals.

The most useful defensive lesson is to look for the combination: unexpected multi-provider AI traffic alongside credential access, injection, persistence, staged files, and webhook exfiltration. That approach remains relevant even as individual malware builds, providers, or delivery methods change.

Sources

Cisco Talos: “The Closed Quorum: Inside the first reported autonomous AI C2 implant”