Executive Summary
Cisco Talos has identified CLOSEDQUORUM, a Windows malware implant that delegates tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs), allowing portions of an intrusion to operate without continued human direction or a traditional attacker-controlled C2 server. The malware can query up to four LLM providers, including DeepSeek, Qwen, Mistral, and Google Gemini, to select among predefined malicious actions including credential theft, process injection, and persistence, while reporting decisions and stolen data through Discord. Although Talos has not confirmed CLOSEDQUORUM's deployment in the wild and the publicly distributed build is nonfunctional, the malware demonstrates how threat actors can use existing AI services to automate bounded portions of the attack chain and reduce their dependence on human operators.
Key Takeaways
- CLOSEDQUORUM is the first publicly documented Windows implant known to delegate tactical C2 decision-making to commercial LLMs rather than relying on continuous human tasking.
- CLOSEDQUORUM can query DeepSeek, Qwen, Mistral, and Google Gemini sequentially and use plurality voting to determine which malicious capability should execute next.
- Implemented capabilities include LSASS credential dumping, browser credential theft, cryptocurrency wallet theft, process injection, and persistence.
What is CLOSEDQUORUM?
CLOSEDQUORUM is a 16.4 MB, 64-bit Windows executable written in Go and discovered through Cisco Talos' Cognitive Artifact Intelligence Research Network (CAIRN) project. Unlike conventional malware that receives commands from attacker-operated C2 infrastructure, CLOSEDQUORUM is designed to delegate tactical decisions to commercial LLM services. The architecture allows up to four LLM providers - DeepSeek, Qwen, Mistral, and Google Gemini - to participate in a decision-making "quorum." Each model receives information about the compromised host and returns a structured recommendation for the malware's next action. The responses are then aggregated, and the action receiving the most votes is executed.
Rather than allowing the models unrestricted control, CLOSEDQUORUM constrains their responses to a structured JSON schema representing a limited set of predefined actions. This design effectively uses the LLMs as a reasoning and decision layer sitting above conventional malware capabilities. Although Talos has not confirmed deployment in the wild, artifacts associated with the binary connected its developer to criminal-forum postings related to carding dating back to 2025.
How the LLM-as-C2 Architecture Works
Traditional malware C2 typically depends on attacker-controlled infrastructure such as domains, IP addresses, protocols, and listening servers. That infrastructure can provide defenders with observable and potentially blockable indicators.
CLOSEDQUORUM instead sends requests to legitimate commercial LLM services used by many benign applications. The LLM services act as the tactical decision mechanism, eliminating the need for a dedicated attacker-operated C2 server to continuously provide tasking, although the malware still uses external services such as Discord for telemetry and exfiltration.
During initialization, CLOSEDQUORUM gathers information including:
- Hostname
- Operating system architecture
- CPU count
- Windows version
- Administrative privilege status
- Current target process
This information becomes context supplied to the LLMs. Each provider then returns a structured response containing a decision and associated parameters. The responses are aggregated using plurality voting. If multiple decisions receive the same number of votes, the malware resolves the tie according to provider order: DeepSeek first, followed by Qwen, Mistral, and Gemini. This behavior makes tie resolution deterministic rather than random. If all queried models fail to provide usable responses, CLOSEDQUORUM falls back to a consensus value that does not correspond to an implemented capability. The malware consequently sleeps before retrying, rather than automatically executing another action.
Malicious Capabilities
The LLM decision layer can select from a constrained collection of actions implemented within the malware, as described below.
Credential and Data Theft
The steal decision simultaneously launches three theft functions:
- LSASS credential dumping for Windows domain and local credentials
- Saved browser credential theft targeting Chrome, Edge, and Firefox
- Cryptocurrency wallet theft targeting MetaMask, Exodus, and Ethereum wallet data
Stolen information is encrypted using AES-256-GCM and transmitted to the operator through Discord.
Process Injection
The inject decision invokes shellcode generation then selects an injection mechanism. A process_hollow selection routes execution to a process-hollowing implementation, while other selections can invoke Early Bird APC injection.
Persistence
The persist decision invokes the malware's persistence functionality. Talos also identifies WMI persistence creation among the behaviors defenders can correlate with CLOSEDQUORUM's network activity. A fourth decision, move, exists within the decision schema but does not have a corresponding handler in the publicly distributed build.
From AI Assistance to Effort Displacement
Much of the security discussion surrounding offensive AI has focused on speed and scale. Generative AI can help attackers produce phishing content, write or modify code, and accelerate other tasks, but the attacker typically remains responsible for directing the operation. CLOSEDQUORUM demonstrates a different model that Talos describes as effort displacement. Rather than simply helping an attacker perform a task faster, the system transfers decision-making for a bounded portion of the attack chain from the human operator to an AI-driven system. Once deployed, the implant can repeatedly assess its available context, ask the LLM panel what action should occur next, and execute the selected capability without waiting for new instructions from the attacker.
This architecture could reduce several constraints traditionally associated with human-operated intrusions. Human attackers have finite attention, working hours, and cognitive capacity. An autonomous decision loop can continue operating while the attacker is offline, allowing automation to compound the speed and scale advantages already associated with AI-assisted offensive activity.
Potential Operating Model
Talos assesses that CLOSEDQUORUM appears to be designed to operate as an operator-configured service rather than malware deployed directly by its developer. The publicly observed distribution binary analyzed by Cisco Talos is an inert template containing placeholder LLM API credentials and a dummy Discord webhook. Development artifacts, however, indicate that customized builds could be compiled with an individual operator's LLM credentials and Discord webhook before delivery. The operator would then be responsible for deploying the configured executable.
Under Talos's assessed model, stolen credentials would be encrypted and delivered through the operator's Discord channel. If operated as Talos assesses, CLOSEDQUORUM could function as a credentials-as-a-service offering in which autonomous LLM orchestration serves as a differentiating capability. Importantly, this is an assessed operating model rather than evidence that CLOSEDQUORUM is currently being deployed at scale.
Analyst Commentary
CLOSEDQUORUM is significant, not because it represents an especially sophisticated malware family or because autonomous AI malware has suddenly become widespread, but because it demonstrates a practical architecture for removing the human operator from a bounded portion of an intrusion. The distinction between AI-assisted and AI-directed malicious activity is important. In many applications of generative AI to cyber operations, the model improves an attacker's productivity while the attacker continues making operational decisions. CLOSEDQUORUM reverses part of that relationship. The developer defines the available capabilities and constraints, but the LLM layer decides which implemented action should execute next.
The malware also demonstrates that autonomous offensive AI does not require a model to invent an attack from scratch. Constraining the model to a small decision space may make the architecture more practical. CLOSEDQUORUM's LLMs are not asked to independently compromise a system. Instead, they receive host context and choose among predefined capabilities that conventional malware code then executes. However, there are substantial limitations. CLOSEDQUORUM remains dependent on commercial AI infrastructure and is vulnerable to provider refusals, API rate limits, malformed responses, predictable voting behavior, and the limited capabilities implemented by its developer. Talos notes that replacing human decision-making with model-driven automation exchanges some human limitations for model and infrastructure limitations.
The larger concern is not CLOSEDQUORUM itself, but the architectural precedent it represents. If attackers can automate tactical decisions within one bounded phase of an intrusion, the same approach can potentially be extended across additional portions of the attack chain. At the same time, malware increasingly operating through legitimate cloud, communications, and AI infrastructure puts pressure on defenses that depend heavily on known malicious destinations or previously identified indicators. In this environment, defenders need broad visibility into emerging malware artifacts and the ability to evaluate suspicious files using multiple independent detection perspectives rather than waiting for a single vendor or indicator to identify a new threat.
This is where PolySwarm's crowdsourced approach to malware detection becomes increasingly relevant. By aggregating verdicts from a diverse marketplace of security engines and threat-detection experts, PolySwarm can provide additional context around suspicious and emerging files while reducing dependence on any single detection technology. As malware development becomes faster, more adaptive, and increasingly augmented by AI, organizations benefit from detection strategies that are similarly distributed and capable of incorporating multiple independent assessments. CLOSEDQUORUM may be an early and limited example, but defenders do not need to wait for autonomous malware to mature before preparing for it. Organizations can use PolySwarm to strengthen malware triage, enrich threat intelligence workflows, and gain broader detection coverage as emerging threats evolve beyond traditional C2 and static-indicator models.
IOCs
PolySwarm has multiple samples of CLOSEDQUORUM.
250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7
c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7
c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f
f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c
5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb
eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5
Click here to view all samples of CLOSEDQUORUM in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
