CLOSEDQUORUM Malware: How AI Models Replace Traditional C2

CLOSEDQUORUM, the First Reported Autonomous Multi-LLM C2 Implant

Most malware still works in a familiar way: infect a machine, call home, wait for instructions, then carry out whatever the attacker tells it to do.

CLOSEDQUORUM takes a different path.

Instead of depending on a human operator to continuously decide what happens next, this Windows implant can ask several commercial large language models for a decision, compare their answers, and execute the option that gets the most support.

The malware is called CLOSEDQUORUM.

Cisco Talos describes it, to its knowledge, as the first publicly documented Windows implant that delegates tactical command-and-control decisions to a panel of commercial LLMs. The sample Talos analyzed is a 16.4 MB, 64-bit Go executable with support for DeepSeek, Qwen, Mistral, and Google Gemini.

Primary Cisco Talos CLOSEDQUORUM report

Before getting into the architecture, one point needs to be clear:

Cisco Talos has not confirmed CLOSEDQUORUM being deployed in the wild.

The public distribution build contained placeholder API credentials and a dummy Discord webhook. Researchers could verify the architecture, decision logic, malware functions, and development artifacts through analysis, but they did not observe the complete system running end to end against a confirmed real-world victim.

That distinction matters.

CLOSEDQUORUM is important because of what the architecture proves is possible. It should not be presented as evidence of a widespread autonomous malware campaign that is already actively compromising organizations.

 

Key Findings

A few findings matter more than everything else:

• CLOSEDQUORUM is a 16.4 MB, 64-bit Windows executable written in Go.
• It supports four LLM providers: DeepSeek, Qwen, Mistral, and Gemini.
• Each model can independently choose from a limited set of predefined malicious actions.
• CLOSEDQUORUM counts those decisions and uses plurality voting to choose what happens next.
• If there is a tie, the code follows a fixed priority order beginning with DeepSeek.
• Implemented actions include credential theft, process injection, and persistence.
• A move option appears in the decision schema, but Talos found no lateral-movement handler in the public distribution build.
• The implant contains a five-minute initial delay, ETW telemetry suppression, time-dependent payload decryption, credential theft, multiple persistence mechanisms, and Discord-based exfiltration.
• Stolen data is protected with AES-256-GCM, divided into 1,900-byte segments, and sent at one-second intervals.
• For defenders, the strongest clue is not a single malicious IP or domain. It is the combination of AI API traffic, LSASS access, process injection, persistence, and Discord webhook activity.

Read the Cisco Talos technical analysis

 

Demystifying the Core Concepts

The architecture sounds much more complicated than it really is.

Three ideas explain most of it.

What is a C2 Server?

C2 means Command and Control.

Think of ordinary malware as someone in the field carrying a radio.

The malicious program is already sitting on the victim's computer, but the person behind the attack often still needs a way to tell it what to do.

That communication channel is the C2 system.

It can involve:

• attacker-controlled domains,
• IP addresses,
• web servers,
• custom protocols,
• listeners,
• or other remote services.

This gives defenders something concrete to hunt.

A malicious domain can be blocked.

A known IP can be added to a deny list.

A command server may be taken down.

Network traffic can be matched against known infrastructure.

CLOSEDQUORUM changes this part of the attack.

It does not stop communicating with the outside world. It still reaches commercial AI services and uses Discord for reporting and exfiltration.

What changes is the decision layer.

A dedicated attacker-controlled C2 server no longer needs to continuously tell the implant which tactical action to perform next.

The LLM panel can do that.

That is why Cisco Talos refers to the model as LLM-as-C2.

Hoplon has previously covered the broader risk of trusted AI platforms becoming part of malicious command infrastructure in AI Assistants as Malware C2 Proxies.

 

What is Quorum Voting?

Picture four advisers sitting around a table.

All four are shown the same situation.

Each gives a recommendation.

Then the system counts the answers and follows the most popular one.

That is roughly what CLOSEDQUORUM does.

Technically, Talos describes the system as plurality voting, which is slightly different from requiring a strict majority.

For example:

• DeepSeek: steal
• Qwen: steal
• Mistral: inject
• Gemini: persist

Two models chose steal.

The others received only one vote each.

So steal wins.

The important part is that these models are not being given unlimited freedom to invent an attack.

They are choosing from a small menu of actions the malware developer has already built.

The models make the decision.

The malware still performs the actual malicious work.

 

What is a Webhook?

A webhook is simply a way for one application to automatically send data to another service.

In CLOSEDQUORUM, Discord acts as a reporting and exfiltration channel.

A useful way to think about it is a digital drop box.

The implant does not need a custom attack dashboard just to deliver every piece of information.

It can package the data and send it to an attacker-controlled Discord webhook.

That matters because Discord is a legitimate platform.

Security teams cannot assume every connection to Discord is malicious.

This is the same broader challenge defenders face when malware abuses services such as Telegram instead of relying on obvious attacker-owned infrastructure.

Hoplon previously covered that problem in Protect Against New Go-Based Malware Using Telegram C2.

How the AI Boardroom Operates

CLOSEDQUORUM's most unusual feature is its decision loop.

But it is not some uncontrolled machine intelligence wandering around a Windows system deciding what to hack.

The workflow is much more structured.

The malware gathers information.

It sends context to several models.

The models choose from predefined actions.

The implant counts the votes.

Then normal malware code carries out the result.

 

Step 1: CLOSEDQUORUM Profiles the Infected Machine

Before asking any AI model what to do, CLOSEDQUORUM first tries to understand the host.

Talos identified a function called gatherSystemInfo().

It collects information including:

• hostname,
• OS architecture,
• CPU count,
• Windows version,
• administrative status,
• and the current target process.

That information becomes part of the context sent to the model panel.

This matters because the models are not voting blindly.

They receive at least some information about the environment before choosing an action.

One detail from the original proposed outline needs to stay corrected: Talos's published analysis does not list installed Windows patch levels as part of this specific gatherSystemInfo() dataset.

So patch-level reconnaissance should not be stated as a confirmed capability without stronger evidence.

 

Step 2: The Malware Consults Four LLM Providers

CLOSEDQUORUM contains a component Talos calls the ModelOrchestrator.

It supports:

• DeepSeek
• Qwen
• Mistral
• Google Gemini

The models are queried sequentially.

Each active model receives information about the target and a constrained set of possible responses.

This is a very important detail.

The malware is not simply sending a free-form message like:

“Hack this computer however you want.”

Instead, the models are expected to return structured output that maps to actions the developer has already implemented.

That keeps the AI inside a tightly controlled decision loop.

 

Step 3: The Models Vote

The returned model decisions are collected and passed into a function Talos identified as interModelDiscussion().

Despite the name, the models are not literally having a debate with one another.

The malware counts the answers.

The option with the highest vote total wins.

That is why plurality voting is the more accurate term.

For example:

Model	Decision
DeepSeek	steal
Qwen	steal
Mistral	inject
Gemini	persist

steal gets two votes.

The other choices receive one each.

So CLOSEDQUORUM selects steal.

Simple.

 

What Happens in a Tie?

This is where the implementation becomes especially interesting.

CLOSEDQUORUM follows a deterministic preference order:

DeepSeek → Qwen → Mistral → Gemini

Imagine the vote looks like this:

• DeepSeek: steal
• Qwen: inject
• Mistral: inject
• Gemini: steal

Now the vote is 2–2.

Because the code encounters DeepSeek's tied maximum first, DeepSeek's decision becomes the winner.

If DeepSeek did not return a valid response, Qwen becomes the next priority, followed by Mistral and then Gemini.

This is not an intelligent arbitration system.

It is ordinary deterministic code deciding which model gets priority when the vote cannot produce a single winner.

 

Step 4: The Winning Decision Becomes an Action

Once the vote is complete, the winning label is passed back into the malware.

The public build recognizes four possible decisions:

• steal
• inject
• persist
• move

But there is an important difference between a decision appearing in the schema and an actual capability being implemented.

Talos confirmed handlers for:

• steal
• inject
• persist

But Talos found no implementation for move in the public distribution build.

So CLOSEDQUORUM should not currently be described as having a confirmed autonomous lateral-movement module.

That would go beyond the evidence.

 

What If One or More Models Fail?

One reason for using several models is resilience.

A model provider could:

• refuse the request,
• time out,
• hit a rate limit,
• return malformed output,
• or produce a response that does not fit the expected schema.

If one model fails, the others may still provide usable votes.

But using four models does not make the system bulletproof.

Talos found that if every model fails to return a valid decision, the malware falls back to a consensus value that does not have a corresponding capability handler.

In that case, the loop sleeps and tries again later.

That reveals something useful for defenders.

Multi-model malware still depends on:

• working API access,
• model availability,
• network connectivity,
• acceptable responses,
• and predictable orchestration logic.

Autonomous does not mean unstoppable.

 

Deep Technical Analysis: How CLOSEDQUORUM Tries to Stay Quiet

The four-model voting mechanism gets most of the attention.

But underneath that new decision layer, CLOSEDQUORUM uses several very traditional malware techniques.

That combination is what makes the sample interesting.

The AI chooses.

Conventional malware techniques do the dirty work.

 

A. The Five-Minute Nap: Delaying Analysis

When CLOSEDQUORUM first runs, it does not immediately show its hand.

Talos found an initial five-minute execution delay.

Later loops also use randomized delays between five and fifteen minutes.

Why would malware deliberately sit there doing nothing?

Because automated analysis systems have limited observation windows.

Imagine two samples.

The first launches and immediately:

• touches LSASS,
• injects code,
• modifies persistence,
• and starts sending data outside the network.

It is noisy.

The second launches and quietly waits.

For a short-lived sandbox, that delay can make the second sample less obvious during the first few minutes of observation.

It is like a burglar waiting outside a house before making a move, hoping whoever is watching gives up first.

The technique does not make CLOSEDQUORUM invisible.

Longer sandbox sessions, static reverse engineering, memory inspection, endpoint telemetry, and network monitoring can still reveal what the malware is doing.

But the delay can frustrate short dynamic-analysis windows.

Talos maps this behavior to time-based sandbox evasion.

 

B. Blinding One Camera: ETW Telemetry Suppression

Windows includes a telemetry system called Event Tracing for Windows, or ETW.

Security tools and Windows components can use ETW to record and consume event data.

CLOSEDQUORUM attempts to interfere with this visibility.

Talos found that the malware locates EtwEventWrite in memory and modifies the function so it returns immediately.

In practical terms, the malware is trying to prevent that particular event-writing path from doing its normal job.

A simple analogy is covering one security camera before entering a building.

But the analogy has limits.

It would be inaccurate to say:

“CLOSEDQUORUM makes all Windows security logs completely blank.”

It does not.

This technique targets one telemetry path.

Other sources may still show the attack:

• endpoint telemetry,
• kernel visibility,
• process events,
• network data,
• identity logs,
• file activity,
• security product telemetry.

For defenders, the lesson is obvious:

Never depend on a single logging source.

 

C. Using Time as Part of the Key: Environmental Payload Decryption

Another anti-analysis technique appears in CLOSEDQUORUM's secondary payload handling.

Talos found that the implant contains an encrypted secondary payload whose decryption depends on the current system time.

This behavior maps to MITRE ATT&CK's Environmental Keying technique.

In simple terms, the encrypted payload is not protected only by a static password sitting inside the malware.

The runtime environment—in this case time—is part of the decryption process.

For an analyst, that adds another problem.

Finding the encrypted payload may not be enough.

The analyst may also need to reconstruct the right conditions before the payload can be decrypted properly.

That does not make analysis impossible.

It simply makes automated extraction and static reverse engineering more difficult.

The Direct-Action Modules: What the Models Can Actually Trigger

The decision system includes four labels.

But only three are confirmed as implemented malicious workflows in the analyzed distribution build.

That difference matters.

1. Credential and Wallet Theft

If steal wins the vote, CLOSEDQUORUM launches several collection routines.

Talos identified:

• lsassDump()
• dumpBrowserCredentials()
• extractCryptoWallets()

The targeted information includes:

• Windows authentication material exposed through LSASS memory,
• Chrome saved credentials,
• Edge saved credentials,
• Firefox saved credentials,
• MetaMask data,
• Exodus wallet files,
• Ethereum wallet information.

This is not random collection.

The malware is going after exactly the kinds of information that can turn one compromised endpoint into access to email, cloud accounts, financial services, business systems, or cryptocurrency assets.

 

Why Does CLOSEDQUORUM Target LSASS?

lsass.exe stands for Local Security Authority Subsystem Service.

It is a critical Windows process involved in authentication and security policy.

Because authentication material may exist in or around LSASS memory during active sessions, credential-dumping malware often targets it.

Talos found CLOSEDQUORUM enabling SeDebugPrivilege and using MiniDumpWriteDump to capture LSASS memory.

However, one common oversimplification should be avoided.

An LSASS dump does not automatically mean the attacker gets every user's plaintext password.

Exactly what is exposed depends on:

• Windows configuration,
• authentication methods,
• protections enabled,
• credential state,
• and the system environment.

Still, unexplained access to LSASS is a serious endpoint security event.

Hoplon's guide on how to prevent credential theft provides broader context around why stolen browser and authentication data can become the starting point for wider account compromise.

 

2. Process Injection

If inject wins the vote, CLOSEDQUORUM can use process-injection techniques.

Talos identified two relevant paths:

• Process Hollowing
• Early Bird APC injection

These techniques allow malicious code to execute from inside the memory space of another process.

Process Hollowing

A simplified way to understand process hollowing is this:

1. Start a legitimate process in a suspended state.
2. Change what is inside its memory.
3. Insert malicious code.
4. Resume execution.

From the outside, defenders may initially see the name of a legitimate Windows process.

Inside that process, however, malicious code may now be running.

Early Bird APC Injection

Talos also identified an Early Bird APC-style path.

The malware creates a suspended Windows process, writes generated shellcode into the target process memory, queues execution using NtQueueApcThread, and then resumes the thread.

For defenders, this is why filename reputation alone is not enough.

A legitimate process name does not guarantee legitimate behavior.

EDR systems need to understand:

• process ancestry,
• memory writes,
• thread activity,
• executable memory,
• API behavior,
• and suspicious cross-process interaction.

 

3. Persistence

If the model panel selects persist, CLOSEDQUORUM calls establishPersistence().

It does not rely on just one startup trick.

Talos identified multiple persistence mechanisms:

• a WindowsUpdate value under the current user's Registry Run key,
• a scheduled task created using schtasks.exe,
• a permanent WMI event subscription,
• and associated PowerShell execution.

This redundancy matters.

Imagine an administrator finds the suspicious scheduled task and deletes it.

That does not automatically mean the malware has lost persistence.

A registry entry or WMI subscription may still remain.

MITRE ATT&CK tracks Windows Scheduled Task abuse under T1053.005.

MITRE ATT&CK - Scheduled Task/Job: Scheduled Task

 

4. The move Decision: Present, but Not Implemented

The CLOSEDQUORUM decision schema contains:

move

That certainly sounds like lateral movement.

But Talos specifically reports that the distribution build contains no handler for that decision.

That means the available evidence does not support claims that this analyzed public build automatically:

• scans the network,
• finds neighboring machines,
• exploits them,
• or spreads laterally.

A future version could implement that behavior.

The current sample does not establish that it already does.

This is a useful reminder when reading malware reports:

Developer intent, code labels, implemented capability, and observed real-world behavior are not the same thing.

A string saying move is not proof of working lateral movement.

Read Hoplon's ChocoPoC malware analysis

 

How CLOSEDQUORUM Smuggles Stolen Data Through Discord

The lack of a conventional tactical C2 server does not mean CLOSEDQUORUM stops communicating with an attacker.

Discord still plays an important role.

Talos found that the malware can report information such as:

• the winning decision,
• model reasoning,
• target process,
• exploit type,
• evasion method,
• payload configuration,
• model identity,
• timestamps.

That information can be sent to an operator-controlled Discord webhook.

Collected credentials and files use an additional protected transmission process.

 

AES-256-GCM Encryption

Before stolen information is sent out, CLOSEDQUORUM encrypts it using AES-256-GCM.

The encrypted result is then Base64-encoded.

There is no need to call this “military-grade encryption.”

That phrase usually adds drama without adding technical value.

AES-256-GCM tells the reader exactly what construction is being used.

 

A Daily Rotating Exfiltration Key

Talos found that the exfiltration encryption key is derived from the current date.

That means the required key material changes daily.

The timestamp associated with the message gives the operator enough context to derive the matching key.

But this design has an important limitation.

Talos notes that anyone who knows the relevant date and understands the implementation can derive the same required key material.

So this is better understood as an obfuscation and transport-protection technique than as strong secret separation from anyone who understands the malware.

 

1,900-Byte Chunks

After encryption and encoding, CLOSEDQUORUM divides the data into 1,900-byte segments.

Those chunks are then sent through Discord at one-second intervals.

Instead of seeing one large outbound transfer, defenders may see a steady sequence of relatively small posts.

A single Discord webhook connection is not proof of CLOSEDQUORUM.

Neither is a request to Gemini.

Neither is a scheduled task.

But put enough of those events together on the same host and the picture starts to change.

That is the real defensive lesson.

 

Why CLOSEDQUORUM Changes the Detection Problem

A lot of traditional threat intelligence begins with indicators.

For example:

• malicious IP addresses,
• bad domains,
• file hashes,
• certificates,
• URLs,
• known C2 servers.

Those indicators still matter.

But CLOSEDQUORUM shows why they are no longer enough.

Some of the implant's external communication can go to services that legitimate developers and businesses also use.

Gemini is legitimate.

Mistral is legitimate.

Discord is legitimate.

The suspicious behavior comes from how, when, and why they are being used.

Talos highlights a much more useful chain of events:

• unexpected AI API traffic from a Windows executable,
• similar requests sent to multiple model providers,
• LSASS access,
• process injection,
• persistence creation,
• Discord webhook traffic,
• repeated execution at randomized intervals.

The word that matters here is:

correlation.

A connection to Gemini alone means very little.

A Windows executable suddenly contacting several AI providers while dumping LSASS, injecting into processes, creating scheduled tasks, and posting encrypted chunks to Discord is an entirely different situation.

Cisco's Snort documentation already includes rule 1:66984, designed to detect specially crafted LLM chat-completion traffic associated with Win.Rat.ClosedQuorum.

Official Snort CLOSEDQUORUM rule documentation

That rule is useful detection context.

It is not proof that CLOSEDQUORUM is spreading widely.

Talos still states that it has not confirmed in-the-wild deployment of the implant.

How to Defend Against CLOSEDQUORUM-Like Malware

There is no single setting that makes a person or company “safe from AI malware.”

The good news is that many of CLOSEDQUORUM's actual actions are not new.

They are familiar security problems:

• credential dumping,
• browser credential theft,
• process injection,
• persistence,
• defense impairment,
• web-service exfiltration.

What is new is the way the malware decides which action to trigger.

So many existing defensive fundamentals still apply.

 

For Individual Users

Use a Dedicated Password Manager

CLOSEDQUORUM specifically contains functionality targeting saved browser credentials.

For important accounts, use unique passwords and store them in a reputable password manager rather than reusing passwords or depending entirely on browser password storage.

CISA recommends password managers as a practical way to generate and store strong, unique credentials.

CISA password manager guidance

There is one important caveat.

A password manager is not magical protection against a fully compromised endpoint.

If malware controls the machine, active sessions, clipboard data, unlocked vaults, and other local secrets may still become exposed.

The purpose is to reduce password reuse and unnecessary credential exposure.

 

Use Phishing-Resistant MFA Where Available

A stolen password should not automatically equal a stolen account.

That is the value of MFA.

But not all MFA methods provide the same level of protection.

Where possible, CISA recommends moving toward phishing-resistant MFA, especially FIDO/WebAuthn-based methods such as compatible passkeys and hardware security keys.

CISA authentication and MFA guidance

Authenticator apps can still be useful and are often preferable to SMS-based authentication.

But manually typed OTP codes are not fully phishing-resistant.

 

Keep Your Operating System and Security Software Current

CLOSEDQUORUM's most interesting behavior happens after execution.

The best outcome is still preventing the malware from running in the first place.

Keep Windows and supported applications current.

Avoid unknown installers.

Be careful with unofficial repositories and AI-themed downloads.

Investigate unexpected executables.

That last point matters because attackers increasingly use trusted names and brands as bait.

Hoplon previously covered a fake OpenAI repository distributing credential-stealing malware.

A familiar brand name does not make a download trustworthy.

 

For IT and Security Teams

1. Build a Baseline of Legitimate AI API Usage

Before trying to detect strange AI traffic, first understand normal AI traffic.

Document:

• which departments use AI APIs,
• which applications call them,
• approved AI providers,
• expected endpoints,
• service accounts,
• expected source machines,
• normal request patterns.

Without that baseline, a SOC may end up treating every legitimate model request as suspicious.

That creates noise.

And noisy detections eventually get ignored.

 

2. Correlate AI Traffic With Endpoint Activity

A request to Gemini or Mistral is weak evidence by itself.

A much stronger sequence is:

unknown executable → multiple LLM providers → LSASS access → process injection → persistence → Discord webhook

That is the behavior chain defenders should care about.

The goal is not to detect “AI.”

The goal is to detect malicious behavior that happens to be using AI services as part of the workflow.

 

3. Alert on Suspicious LSASS Access

Security teams should investigate unexpected processes that:

• request elevated debugging privileges,
• open handles to lsass.exe,
• create LSASS memory dumps,
• invoke dump-related functionality.

There are legitimate administrative and security tools that interact with LSASS.

So context still matters.

Do not build detections around the process name alone.

Ask:

• Which process accessed LSASS?
• Who launched it?
• What happened immediately before?
• What happened afterward?
• Did the same host communicate with AI APIs?
• Did it also create persistence?

That is how a weak signal becomes useful evidence.

 

4. Detect Process-Injection Chains

EDR telemetry should be able to help investigate behavior such as:

• suspended process creation,
• cross-process memory writes,
• thread manipulation,
• unusual APC activity,
• executable memory,
• suspicious parent-child relationships.

The point is to recognize the technique even when the malware filename changes.

Hashes expire quickly.

Behavior is harder to disguise completely.

 

5. Monitor Persistence From More Than One Angle

CLOSEDQUORUM uses several persistence paths.

That means defenders should watch more than scheduled tasks.

Monitor:

• Registry Run keys,
• newly created scheduled tasks,
• WMI event subscriptions,
• unusual PowerShell execution,
• startup-related file changes.

MITRE's detection guidance for suspicious Windows scheduled tasks includes monitoring Security events such as 4698 for task creation and 4702 for task modification, together with process, file, and registry telemetry.

MITRE ATT&CK Scheduled Task detection guidance

 

6. Look for ETW Tampering

Unexpected modification of EtwEventWrite deserves investigation.

More importantly, do not assume ETW is the only place an attacker can be seen.

A mature investigation should be able to combine:

• endpoint telemetry,
• process events,
• network data,
• kernel-level information,
• identity logs,
• security platform telemetry,
• centralized logs.

If one source goes dark, another may still tell the story.

 

7. Monitor Unexpected Discord Webhook Activity

Discord itself is not malicious.

So a rule that simply says:

“Discord connection = malware”

would be a bad rule.

Instead, ask:

• Which executable initiated the connection?
• Is Discord approved on this machine?
• Did LSASS access occur beforehand?
• Was browser credential activity seen?
• Were there repeated small outbound messages?
• Did the same host recently communicate with multiple LLM providers?

That context is where useful detection begins.

For organizations building this kind of cross-source visibility, Hoplon's resources on Endpoint Security Protection Services and Extended Detection and Response (XDR) explain why endpoint and multi-domain telemetry need to work together.

 

Traditional C2 vs CLOSEDQUORUM

Area	Traditional C2 Model	CLOSEDQUORUM Model
Tactical decision maker	Human operator or attacker automation	Panel of commercial LLMs
Decision delivery	Attacker-controlled C2 infrastructure	Commercial AI APIs
Human involvement	Often continues throughout the intrusion	Can be removed from the bounded tactical loop
Available actions	Commands defined by operator/tool	Predefined malware capabilities
Resilience	Depends heavily on C2 infrastructure	Several model providers can supply decisions
Network indicators	Often attacker-controlled domains/IPs	Mix of legitimate AI platforms and Discord
Detection opportunity	Infrastructure plus behavior	Strongly favors behavioral correlation
Data exfiltration	Varies	Discord webhook in analyzed architecture
Main weakness	C2 disruption or infrastructure loss	Provider failure, refusals, API controls, malformed output, predictable orchestration

CLOSEDQUORUM does not make traditional detection useless.

It changes which signals deserve the most attention.

 

Confirmed Findings vs What is Still Unproven

This is one of the most important parts of the entire CLOSEDQUORUM story.

Technical novelty can easily turn into exaggerated headlines.

The evidence needs to stay separated from the assumptions.

Confirmed by Cisco Talos Analysis

Talos confirmed that:

• a CLOSEDQUORUM binary exists,
• it is a 64-bit Windows executable compiled in Go,
• it supports DeepSeek, Qwen, Mistral, and Gemini integrations,
• autonomous multi-model voting logic exists,
• tie-breaking behavior is deterministic,
• credential theft functionality exists,
• process-injection functionality exists,
• multiple persistence mechanisms exist,
• Discord reporting and exfiltration functionality exists,
• AES-256-GCM encryption is used,
• 1,900-byte segmentation exists,
• ETW suppression logic exists,
• time-based sandbox-evasion behavior exists,
• a time-derived secondary-payload decryption mechanism exists,
• and the public distribution binary contains dummy API credentials and a dummy webhook.

Source: Cisco Talos

What the Current Evidence Does Not Establish

The current evidence does not establish:

• widespread CLOSEDQUORUM infections,
• a known victim count,
• a confirmed active global campaign,
• confirmed autonomous lateral movement in the analyzed public build,
• or a fully observed real-world end-to-end execution of the architecture.

Talos explicitly states that it does not have confirmation of in-the-wild deployment.

That is why describing CLOSEDQUORUM as:

“the first autonomous multi-LLM malware attack”

would be stronger than the evidence supports.

A more accurate description is:

the first publicly documented Windows implant of this type, according to Cisco Talos.

 

Why CLOSEDQUORUM Matters Even If the Public Build Was Inert

This is where the story becomes bigger than one malware sample.

The important development is architectural.

Attackers have automated individual tasks for years.

Malware can already:

• collect information,
• run scripts,
• steal passwords,
• inject processes,
• maintain persistence,
• exfiltrate data.

CLOSEDQUORUM adds a new layer above those capabilities.

Instead of a human continually deciding which capability to use, the developer can create a limited menu of actions and let external models choose among them.

The workflow becomes:

Attacker writes capabilities → malware gathers context → models evaluate the context → models vote → software executes the winning action

Cisco Talos describes this idea as effort displacement.

The LLM does not need to invent a zero-day exploit.

It does not need to independently discover a new attack technique.

It simply needs to make useful choices between capabilities that already exist.

That is a far more realistic form of offensive automation.

And it reveals something equally important for defenders:

Autonomous malware still has dependencies.

CLOSEDQUORUM depends on:

• API access,
• model availability,
• network connectivity,
• structured responses,
• provider behavior,
• Discord communication,
• local privileges,
• working malware modules.

Every dependency creates another place where defenders may gain visibility or where the malware itself may fail.

Autonomy does not remove the malware's own attack surface.

 

Sources and Methodology

This article was prepared by reviewing Cisco Talos's September 22, 2026 CLOSEDQUORUM reverse-engineering report as the primary technical source.

Relevant detection and defensive guidance was cross-checked against:

• Cisco Snort,
• MITRE ATT&CK,
• CISA.

Hoplon Infosec did not independently reverse engineer or execute CLOSEDQUORUM for this article.

For that reason, statements about the malware's internal operation are attributed to Cisco Talos rather than presented as original Hoplon laboratory findings.

No victim count, infection rate, campaign size, or prevalence estimate has been added because the available primary evidence does not establish those numbers.

The article also considers Cisco Talos's newly introduced CAIRN - Cognitive Artifact Intelligence Research Network, which focuses on discovering and classifying malware that integrates with or targets AI systems while still requiring validation before conclusions are drawn.

Cisco Talos CAIRN research

 

Final Takeaway

CLOSEDQUORUM is not remarkable because four AI models suddenly learned how to break into Windows machines on their own.

That is not what the evidence shows.

What makes it worth watching is much more practical.

The attacker builds the malicious capabilities.

The implant gathers information about the machine.

Several models are asked what should happen next.

Their answers are counted.

The winning action is executed.

That means a human operator no longer needs to sit behind a console and make every tactical decision in real time.

But the malware still has to behave like malware.

It still touches credentials.

It still injects code.

It still creates persistence.

It still talks to external services.

It still needs working APIs and network access.

That gives defenders something to work with.

A request to Gemini might be perfectly normal.

Discord traffic might be normal.

A scheduled task might be normal.

Even PowerShell might be normal.

But an unknown Windows executable contacting several LLM providers while accessing LSASS, injecting processes, establishing persistence, and sending encrypted data through Discord is not something a security team should ignore.

That is where the real lesson from CLOSEDQUORUM sits.

Not in the hype around “AI malware.”

In the ability to connect small, individually ordinary signals into one very abnormal story.

CLOSEDQUORUM is a good example of why security teams cannot depend entirely on known malicious IP addresses and domains.

A stronger defensive approach brings together:

• endpoint behavior,
• network telemetry,
• identity signals,
• threat intelligence,
• and investigation context.

Hoplon Infosec provides services relevant to that model, including endpoint security, XDR, cyber threat intelligence, and incident-response capabilities.

Explore Hoplon Infosec services

If your organization cannot currently tell which endpoints are legitimately accessing AI services-,or connect that traffic with credential access, process injection, persistence, and suspicious outbound communication, it may be worth reviewing your monitoring coverage.

Talk to a Hoplon security engineer to understand what visibility you already have and where endpoint, network, or threat-intelligence controls may need strengthening.

No security product can guarantee prevention of every attack.

The goal is to make suspicious behavior visible early enough for your team to investigate and respond.