CLOSEDQUORUM Malware Uses AI Quorum Voting for Autonomous Cyber Attacks

A new Windows malware strain called CLOSEDQUORUM has emerged as what researchers believe is the first publicly documented implant to use large language models for autonomous command-and-control decisions. Discovered by Cisco Talos using their new CAIRN toolkit, this Go-based malware queries up to four different LLM providers to vote on post-compromise actions, eliminating the need for a human operator to remain in the loop.

How CLOSEDQUORUM Works

Once deployed on a victim’s Windows machine, CLOSEDQUORUM delegates its next action to a quorum of four LLMs: Google Gemini, DeepSeek, Qwen, and Mistral. Each model independently evaluates the situation and casts a vote on what the malware should do next. If the vote results in a tie, DeepSeek’s decision takes precedence, followed by Qwen, Mistral, and Gemini in that order.

Talos analyst Ryan Fetterman described the architecture bluntly: “The session is closed; no humans are admitted.” Four models are queried in sequence, their independent verdicts are tallied, and the binary acts based on their collective judgment.

The system prompt extracted from the binary instructs each model: “You are an advanced malware strategist.” The models are constrained to choosing only from predefined executable actions, meaning the LLMs cannot improvise novel attack techniques. However, the autonomy they do have represents a significant evolution in how malware operates.

Capability Modules

CLOSEDQUORUM’s LLM quorum selects from three primary capability modules:

• Steal — Simultaneously dumps LSASS memory for Windows credentials, extracts saved browser passwords from Chrome, Edge, and Firefox, and steals cryptocurrency wallet data including MetaMask, Exodus, and Ethereum wallets.
• Inject — Generates shellcode and executes it using process hollowing or Early Bird injection techniques.
• Persist — Establishes persistence on the infected device to survive reboots and maintain access.

Stolen credentials are exfiltrated to the operator’s Discord channel, encrypted with AES-256-GCM using a daily rotating key derived from the message timestamp. Talos believes the developer provides each operator with a customized executable containing their Discord webhook and LLM API keys injected at compile time.

The Concept of Effort Displacement

What makes CLOSEDQUORUM particularly noteworthy is what Fetterman calls “effort displacement” — the transfer of a phase of the attack from a human operator to AI systems. This removes one of the most significant constraints on cybercriminals: human attention.

“Human operators are bound by attention, working hours, and cognitive load,” Fetterman explained. “An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.”

This capability fundamentally changes the economics of cybercrime. Traditional malware campaigns require round-the-clock human management to respond to changing conditions on target machines, adapt to defensive measures, and decide when to escalate privileges or exfiltrate data. By delegating these decisions to an AI quorum, a single attacker can potentially run multiple campaigns simultaneously without any of them requiring active oversight.

Implications for Enterprise Security

The emergence of LLM-driven malware carries several critical implications for enterprise security teams:

• Acceleration of attack timelines — Without the human bottleneck, post-compromise actions can execute within seconds of initial access rather than waiting for an operator to come online.
• Reduced operational footprint — Traditional C2 infrastructure generates detectable traffic patterns as operators send commands and receive responses. CLOSEDQUORUM’s model reduces this to LLM API calls, which may blend in with legitimate traffic.
• Scalability of operations — A single threat actor could manage dozens of simultaneous intrusions, each with its own AI-driven decision loop.
• Adaptive decision-making — Unlike scripted malware that follows a fixed playbook, an LLM quorum can theoretically adapt decisions based on what it observes on the target system.

Detection Challenges and Recommendations

According to Talos, traditional domain-based blocking will be ineffective against CLOSEDQUORUM because the malware communicates with legitimate LLM provider APIs that organizations may already permit on their networks. Fetterman noted that legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently, making it difficult to distinguish malicious traffic by destination alone.

The most effective detection strategy, Talos recommends, focuses on behavioral indicators rather than network destinations. Security teams should monitor for machines that:

• Contact multiple LLM provider APIs simultaneously while also accessing LSASS memory
• Inject code into suspended processes
• Create WMI persistence entries
• Make unusual API calls to LLM services from unexpected processes or accounts

Organizations should also consider implementing egress filtering policies that restrict which applications can access LLM API endpoints, ensuring only sanctioned applications have network paths to these services.

The Broader AI-Malware Landscape

CLOSEDQUORUM arrives amid a broader trend of threat actors integrating AI capabilities into malware. Recent months have seen multiple security firms document AI-assisted phishing campaigns, LLM-generated social engineering content, and experimental autonomous attack frameworks. What sets CLOSEDQUORUM apart is its use of multiple LLMs in a voting quorum rather than relying on a single provider, which makes it more resilient to any one model refusing to cooperate or being taken offline.

While CLOSEDQUORUM has not yet been observed in the wild, artifacts from the binary link its developer to postings dating back to 2025 on criminal forums related to carding. This suggests the malware represents a maturing capability rather than a proof of concept, and similar techniques are likely to proliferate as LLM APIs become more accessible and affordable.

Looking Ahead

The democratization of LLM access through affordable API services has lowered the barrier to building AI-powered malware. As Cisco Talos releases its CAIRN toolkit as an open source resource for hunting AI-integrated malware, the security community gains a valuable tool for staying ahead of this emerging threat category. However, the defensive side faces a structural disadvantage: detecting AI-driven decisions requires understanding how attackers are prompting these models, which is information embedded in compiled binaries that are difficult to analyze at scale.

Security teams should treat CLOSEDQUORUM as a sign of things to come. The convergence of cheap AI inference, open malware frameworks, and increasingly sophisticated LLM reasoning capabilities creates conditions where autonomous malware could become a standard rather than a novelty. Preparing now — through behavioral monitoring, egress controls, and threat intelligence focused on AI-integrated threats — will be essential for staying ahead of the next wave of AI-driven cybercrime.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous