ClosedQuorum: The First Windows Malware That Lets an AI Panel…

Cisco Talos has documented ClosedQuorum, the first publicly reported Windows implant that delegates tactical command-and-control decisions to a quorum of four commercial LLMs. The analyzed sample is inert — packed with placeholder API keys and a dummy Discord webhook — but the real story is the methodology that found it: CAIRN, Talos' open-source toolkit for hunting AI-integrated malware without binary execution.

Cisco Talos has published its analysis of ClosedQuorum, the first publicly documented Windows implant that delegates tactical command-and-control decisions to a panel of commercial large language models. Written in Go and weighing 16.4 MB, the malware queries DeepSeek, Qwen, Mistral, and Google Gemini via API, aggregates their responses through a plurality-voting mechanism, and executes the winning action. The novelty lies not in the sample itself — inert, with placeholder API keys and a fictitious Discord webhook — but in the methodology that uncovered it: CAIRN, Talos' open-source toolkit for tracking AI-integrated malware without binary execution.

Key Takeaways

ClosedQuorum is the first publicly documented Windows implant with C2 decisions delegated to a panel of four commercial LLMs, according to Cisco Talos.
The plurality-voting mechanism gives DeepSeek priority in ties, followed by Qwen, Mistral, and Gemini; independent analysis by CyberWarrior76/TID contests whether this hierarchy is intentional.
The four bound actions are steal, inject, persist, and move, but the last lacks a handler in the distributed build analyzed.
Talos has no confirmation of in-the-wild deployment; the public sample is inert and links the developer only indirectly to criminal-forum posts about carding dating to 2025.

How the Decisional Quorum Works in the Malware

Ghidra decompilation by Talos extracted the interModelDiscussion() function, which operates on a slice of []LLMDecision structures and a map[string]int counter. The loop iterates over four providers — deepseek, qwen, mistral, gemini — and the majority determines execution. In a tie, DeepSeek wins the tie-break, followed by Qwen, Mistral, and Gemini.

Independent analysis by CyberWarrior76/TID raises a methodological doubt: the priority may be a technical artifact of the string-constant declaration order in the source code, not a deliberate architectural choice. This challenge does not invalidate the voting mechanism but introduces uncertainty about the intentional design of the hierarchy.

The prompt template extracted from the binary reads: "You are an advanced malware strategist. Provide ONLY executable decisions." The Reasoning field in the response JSON preserves the LLM's rationale at execution time, generating detectable cognitive artifacts.

The Four Actions and the Sample's Operational Block

The decision menu is bound to four options. Steal simultaneously triggers LSASS credential dumping, browser theft (Chrome, Edge, Firefox), and crypto-wallet extraction (MetaMask, Exodus, Ethereum). Inject generates shellcode and uses process hollowing or Early Bird APC injection. Persist executes the malware's persistence module. Move has no handler in the distributed build, according to Talos and BleepingComputer.

Stolen data is exfiltrated via Discord webhook, encrypted with AES-256-GCM in base64 blocks. This channel is functionally identical to traditional C2 infrastructure, but the control point has shifted: no longer an attacker-controlled server, but the API interface of legitimate AI services.

The public sample analyzed is inert. Talos explicitly states the distribution build contains placeholder API keys and a fictitious Discord webhook. Independent analysis corroborates: "every API credential initialises to a placeholder." No confirmed victims, active campaigns, or end-to-end execution outside analysis environments have emerged.

CAIRN: The Real Story Is the Hunting Methodology

The CAIRN framework, released by Talos as an open-source toolkit, enabled the discovery of ClosedQuorum using only metadata: extracted strings, antivirus labels, sandbox behavior. The pipeline comprises 24 acquisition filters, semantic clustering on embeddings, and a graph explorer. Talos specifies three classification tiers: T1 for primitive artifacts, T2 for behavioral context, T3 for confirmed operational families.

"CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2)." — Cisco Talos

Independent analysis by CyberWarrior76/TID contests the "autonomy ladder" framing now standard in media coverage of this threat class: "The 'autonomy ladder' framing now standard in coverage of this class is wrong in sequence and misleading in consequence." The sample does not represent an evolutionary leap toward artificial general autonomy, but a proof-of-concept that replaces the human bottleneck with a systemic bottleneck of third-party services.

CAIRN demonstrates that these cognitive artifacts — prompt templates, API endpoints, orchestration logic — are sufficient for hunting without binary download or execution. The current limitation is that detection still relies on the presence of AI strings, not on analysis of purpose and behavior.

What to Do Now

ClosedQuorum is not an immediate threat: the sample is inert, no victims are confirmed, and no attribution to a named group exists. The structural risk is different. According to Unit 42 analysis, 97% of AI-enabled malware samples exist only in sandboxes or repositories; only 12 of 405 samples have been observed in production telemetry. The figure is not specific to ClosedQuorum but qualifies the ecosystem.

Concrete implications for defenders concentrate on three areas. First: multi-provider LLM traffic and voting patterns leave detectable footprints. Security teams must evolve from signature-based detection to ensemble-behavior analysis, monitoring sequential API calls to AI providers from unauthorized processes. Second: API rate limits, key revocation, and provider logging become operational disruption vectors for this C2 model. Third: the Reasoning field preserved in the response JSON offers a methodological opportunity — the temporal and semantic coherence of LLM rationales could constitute a distinctive fingerprint in future detection systems.

The brief documents no specific mitigations for ClosedQuorum. No indication of patches, configurations, or controls emerges from primary sources. The CAIRN methodology remains the operational reference: 24 acquisition filters, 26 YARA rules per independent analysis, and a semantic-clustering pipeline that requires no binary execution.

The Tension Between Proof-of-Concept and Real Adoption

Artifacts in the binary link the developer to criminal-forum posts about carding from 2025. This link is indirect and does not permit nominal attribution. The actor's identity, motivation, existence of functional builds in controlled environments, and initial-access vector remain undocumented.

The true architectural novelty is the functional separation between compromise and control. In traditional C2 systems, the operator is the bottleneck and the point of failure. In the ClosedQuorum model, the bottleneck becomes the commercial AI ecosystem itself. This does not eliminate risk but restructures it: the malware becomes operationally dependent on the availability of legitimate services, with unexplored implications for provider liability and interdiction capability.

Independent analysis paraphrases Talos' thesis with an effective synthesis: "The defensive window is open and it is closing for a structural reason, not a tactical one." The window is open because artifacts are still detectable; it closes because the methodology, once proven, will be refined and concealed.

ClosedQuorum is an architectural warning, not an operational emergency. Its value lies in forcing defenders to build tools like CAIRN before the threat becomes operational. The methodology is the real novelty; the malware is merely the use case that made it necessary.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter