Do Son 
Image: Cisco Talos
At a Glance Summary
| Attribute | Details |
|---|---|
| Malware Family | CLOSEDQUORUM |
| Threat Actor | Unknown developer (suspected ties to criminal carding forums since 2025) |
| Target Victims | Windows endpoints, cryptocurrency wallets, and browser credentials |
| Delivery Vector | Custom binary compilation template (in-the-wild delivery unconfirmed) |
| Key Capabilities | Autonomous LLM-driven C2, credential theft, process injection, persistence |
| Source | Cisco Talos (Project CAIRN) |
Executive Summary
The newly identified CLOSEDQUORUM implant introduces autonomous command and control using commercial artificial intelligence providers. The malware queries four large language models to vote on offensive actions like credential theft and process injection. While active intrusions remain unconfirmed, the binary demonstrates how attackers displace human effort by delegating decisions to automated systems.
Delivery and Distribution Model
The public binary discovered by security analysts serves as an inert distribution template. In this build, provider credentials and communication endpoints remain set to placeholder text. Therefore, researchers have not observed confirmed infections in the wild.
However, evidence from development builds indicates a customized delivery model. The author generates tailored binaries containing unique API keys and webhooks for specific buyers. Buyers then distribute the configured executable independently through their own phishing or exploit channels. Security analysts linked the developer to cybercrime forum posts focused on carding schemes dating back to 2025.
Infection Chain Architecture
The compiled binary is a 16.4-megabyte 64-bit Windows executable written in Go. It enables direct system calls by combining Go and C source code during compilation.
When launched, the implant gathers basic system information from the infected host. Specifically, it records the computer hostname, processor count, operating system version, and administrative privileges. Next, the executable embeds these host details into a structured prompt template.
The implant restricts the language model to a strict JavaScript Object Notation schema. The prompt instructs the model: “You are an advanced malware strategist. Provide ONLY executable decisions.” Consequently, the model must select from four specific actions: inject, persist, steal, or move. The implant then executes the chosen routine directly in system memory.
Command-and-Control and Exfiltration Behavior
The primary innovation of the autonomous CLOSEDQUORUM AI malware is its treatment of artificial intelligence providers as operational infrastructure. Traditional malware connects to attacker-controlled domains or internet protocol addresses that defenders quickly block. In contrast, this implant calls commercial application programming interfaces hosted by DeepSeek, Qwen, Mistral, and Google Gemini.
As Cisco Talos noted in the report, “The foundational design choice in CLOSEDQUORUM is the treatment of LLM providers as the C2 infrastructure.” The implant queries each provider in sequence and collects their recommendations into a list. An internal function tabulates the votes and selects the action that receives the most support. If a tie occurs between providers, the code uses a hardcoded preference order that favors DeepSeek first.
Once the quorum selects an action, the implant triggers internal capability modules. For example, selecting the steal action simultaneously runs functions to dump memory from the Local Security Authority Subsystem Service. It also collects saved browser passwords and extracts cryptocurrency wallet keys. The malware encrypts the stolen information using standard symmetric algorithms with daily rotating keys. Finally, it sends the exfiltrated data and model decision logs to an operator channel hosted on Discord.
Defense and Detection Guidance
Because the implant communicates with legitimate technology platforms, static domain blocklists fail to stop it. Security teams must therefore focus on behavioral correlations across endpoint and network telemetry.
Defenders should monitor for standard enterprise executables that generate simultaneous queries to multiple artificial intelligence provider endpoints. Additionally, security systems should flag suspicious processes that combine external machine learning traffic with memory inspection or process injection.
Implementing strict host-based controls remains essential. Administrators should restrict memory access to authentication subsystems and monitor unexpected Discord webhook transmissions. As Talos researchers observed, “CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.” Preparing detection rules for automated decision loops will help organizations defend against emerging autonomous threats.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
