CLOSEDQUORUM: An Autonomous Windows Implant Using Multiple LLMs for Attack Decisions

wpnews.pro

#

Basic Information

Original Title: The Closed Quorum: Inside the first reported autonomous AI C2 implant

- Publisher: Cisco Talos
- Publication Date: 2026-09-22
- Collection Date: 2026-09-23T08:14:06+09:00

**Original Source** :[Cisco Talos](https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/)
- Severity: high

Severity Rationale: Talos statically analyzed a Windows implant that sends host information to up to four commercial LLMs and automatically executes the attack action with the most votes. It includes features for stealing credentials and cryptocurrency wallets, process injection, persistence, and sending data to Discord. However, the publicly distributed version contains dummy API keys and webhooks as a non-functional template, and deployment or execution in a real environment has not been confirmed.

- Related Source: [BleepingComputer: Technical Report](https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/)
- Related Source: [Cisco Talos: CAIRN Research Framework](https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/)
- Related Malware: CLOSEDQUORUM
- Related Threat Group: Unidentified
- CVE: None

Target Products and Services: Windows, DeepSeek, Qwen via OpenRouter, Mistral, Google Gemini, Discord Webhooks

CLOSEDQUORUM is a Go-based Windows implant designed to send structured requests containing host information to DeepSeek, Qwen, Mistral, and Gemini, and then execute theft, injection, and persistence functions selected through plurality voting.

#

Attack Flow

The following is the design confirmed by Talos through static analysis of the binary. Because the publicly distributed version contains dummy credentials, it does not work out of the box, and no execution in a real environment has been confirmed.

Expected Process in a Configured Build

An attacker deploys a binary embedded with an API key and a Discord Webhook to a Windows endpoint.
The implant collects the host name, OS, CPU count, presence of administrator privileges, and target processes.
It sends the same host information and selectable attack actions to up to four LLMs and receives structured JSON responses.
It tallies the Decision fields and selects the action with the highest vote count (plurality vote). Ties are resolved deterministically in provider order: DeepSeek, Qwen, Mistral, and Gemini.
Depending on the selection, it attempts to dump credentials from LSASS memory, collect saved browser credentials and cryptocurrency wallet files, perform Early Bird APC or process-hollowing injection, or establish persistence via Registry Run keys, scheduled tasks, or WMI event subscriptions.
It is designed to send decision details and execution results to a Discord Webhook, and encrypt collected data with AES-256-GCM, Base64-encode it, split it into 1,900-byte segments, and send the segments to a Discord webhook at one-second intervals.

#

Attacker Position and Execution Location

Initial deployment must be performed separately by the attacker. Initial access methods have not been made public.
Tactical action selection after deployment is designed to be handled by the implant on the endpoint and external LLMs, with results sent to Discord.
Real-world operations have not been confirmed for the public version, and it remains unknown whether a configured private build has been deployed.

#

Perspective of Victims and Administrators

Victims

No user-facing prompts are displayed; a configured build is designed to run as background processing.

Administrators

Clues include communication from an unknown Go executable to multiple AI APIs and a Discord Webhook, recurring intervals of 5 to 15 minutes, access to LSASS, browser data, and wallets, process injection, and persistence settings resembling Windows Update.

#

Success and Failure Conditions

Success Conditions

The attacker is able to execute the implant on the endpoint.
Valid LLM API keys and a Discord Webhook are configured at build time and can reach external services.
At least one LLM returns a valid JSON decision that matches the predefined schema and maps to an implemented capability handler.

Failure and Blocking Conditions

Blocking unknown executable files with application control.
Restricting outbound communication to AI APIs and Discord Webhooks that are unnecessary for business, on a per-endpoint or per-process basis.
Failing to obtain valid decisions due to LLM rejections, rate limits, timeouts, or invalid JSON.

#

What Happens Upon Success

If a configured build operates as designed, credentials may be dumped from LSASS memory, and browser credentials and cryptocurrency wallet files may be collected.
Code injection via Early Bird APC or Process Hollowing, and persistence via the registry, scheduled tasks, and WMI are attempted.
Collected data and attack decisions are transmitted to Discord. However, actual damage caused by the public version has not been confirmed.

#

Observable Logs

email : No evidence has been published indicating that email was used for initial access. #

proxy_swg_dns : Observe closely timed communications where a single unknown process connects to multiple AI APIs (such as DeepSeek, OpenRouter, Mistral, and Gemini) and communications with a Discord webhook. #

endpoint_edr : Observe an unknown Go executable, LSASS dumps, access to browser data and wallet files, APC injection, Process Hollowing, and Registry Run keys, scheduled tasks, or WMI event subscriptions resembling Windows Update. #

identity_idp : Observe subsequent use of credentials stored on the compromised endpoint. Public information does not confirm actual credential abuse. #

saas_cloud : Check the usage origins, call volumes, and timestamps of AI API keys and Discord Webhooks. #

network : Observe communications repeating at 5 to 15 minute intervals from the same endpoint to multiple AI services and Discord.

#

Attack Success Determination

Confirmed in Public Information

Implementation Confirmed by Static Analysis (End-to-End Execution Unconfirmed) : Talos confirmed the autonomous decision loop and attack modules through static analysis. However, the public distribution build contains placeholder API keys and a dummy webhook, and Talos did not observe complete end-to-end execution.

Criteria for Internal Judgment

Initial Execution Confirmed : Confirm the execution of a file matching Talos-published SHA-256 hashes or the CLOSEDQUORUM YARA rule, alongside host information collection and AI API calls on the same endpoint. #

Attack Module Execution Confirmed : Corroborate credential theft, injection, or persistence following a valid LLM response using process, file, or registry artifacts. #

Data Exfiltration or Session Compromise Confirmed : Confirm the encryption and temporary storage of collected files and their segmented transmission to a Discord Webhook.

#

Investigation Playbook

Trigger

Initiate investigation when an unknown Windows executable communicates with multiple AI APIs and Discord while simultaneously accessing LSASS or browser data.

Initial Verification

Check file hashes, signatures, source of acquisition, execution time, parent-child processes, and whether valid API keys and webhooks are embedded.
Cross-reference Talos public YARA rules with hashes of development builds.

Endpoint

Preserve LSASS dumps, browser data, wallet files, temporary files in C:\Windows\Temp , registry Run keys, scheduled tasks, WMI subscriptions, and injection target processes.

Authentication and Cloud

Check usage history of AI API keys and Discord Webhooks, and subsequent use of credentials that were accessible from the endpoint.

Follow-up Operations

Track transmission to Discord, authentication using stolen credentials, additional payloads, and lateral movement.

Containment

Isolate the endpoint, terminate related processes, and remove persistence settings.
Revoke and reissue affected AI API keys and endpoint credentials, and delete or regenerate the associated Discord webhooks.

Judgment Classification

Distinguish between public sample acquisition, endpoint execution, LLM querying, attack module execution, data transmission, and subsequent credential use.

#

Defense and Detection Ideas

Single Event

Detect outbound AI API and Discord Webhook communication by unknown Windows executables with high priority.
Detect the creation of registry Run keys, tasks, and WMI subscriptions that mimic Windows Update.

Timeline Correlation

Correlate host information collection, structured requests to multiple AI APIs, plurality vote decisions, credential access or process injection, and Discord transmission within the same process.

Threat Hunting Perspective

Search for Talos published SHA-256 hashes, YARA rules, model names, system prompts, and Discord strings within Go binaries, as well as recurring communications at 5 to 15 minute intervals.

Log Gaps

Prompt contents cannot be confirmed without TLS decryption or logs from the AI provider. Focus on combinations of endpoint processes, memory, file operations, and destinations.

Priority Countermeasures

Control outbound communication to AI APIs and Discord on an application basis, and monitor usage from non-development endpoints.
Apply LSASS protection, minimize credential exposure, and enforce application allowlisting.

#

Facts / Inference / Hypothesis

Facts

The public binary implements a loop that queries up to four LLMs and selects actions based on plurality Decision votes (with deterministic tie-breaking in provider order).
It includes capabilities for stealing LSASS, browser data, and wallets, APC injection, Process Hollowing, and multiple persistence mechanisms.
The LLM API keys and Discord Webhooks in the publicly distributed version are dummies and do not function out of the box.
Talos has not confirmed deployment or operation in real environments.

Inference

Combining closely timed communications from an unknown process to multiple AI APIs with credential access, injection, and Discord communications by the same process creates a characteristic detection condition for this design.

Hypothesis

Artifacts from development builds suggest that private builds with operator-configured API keys and webhooks could be created, but actual deployment remains unconfirmed.

#

MITRE ATT&CK Mapping

The following maps to implementation capabilities confirmed through static analysis and does not indicate confirmed execution in a real environment.

T1055.004 Process Injection: Asynchronous Procedure Call (Confidence: High) — Implements Early Bird APC injection.
T1055.012 Process Injection: Process Hollowing (Confidence: High) — Implements process hollowing.
T1003.001 OS Credential Dumping: LSASS Memory (Confidence: High) — Uses MiniDumpWriteDump to capture LSASS memory.
T1555.003 Credentials from Password Stores: Credentials from Web Browsers (Confidence: High) — Collects credentials from Chrome, Edge, and Firefox.
T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook (Confidence: High) — Sends collected data to Discord.

#

Uncertainties and Further Investigation

Operators other than the developer, victim organizations, and initial access vectors remain unknown.
No evidence has been published showing that a build embedded with valid API keys and webhooks has been deployed to a real environment.
It is unknown whether each AI provider accepted or rejected the actual requests.

#

Impact on SOCs and Organizations

Communications to AI APIs alone should not be treated as malicious. Detections must combine closely timed communications from an unknown process to multiple AI services, access to LSASS and browser data, process injection, and Discord Webhooks. Because the public version is a non-functional template, static capabilities and real-world execution should be handled separately.

#

Summary by Target Audience

For SOCs : In addition to published SHA-256 hashes and YARA rules, correlate multiple AI APIs, credential access, process injection, and Discord communications within the timeline of the same process. #

For Administrators : Control outbound communication to AI APIs and Discord on an application basis, and minimize credentials and API keys. #

For Users : Since user-facing prompts are not expected, report endpoint warnings or suspicious application executions to administrators.

source & further reading

dev.to — original article Data Engineering: Pahlawan Tanpa Tanda Jasa di Balik Era Big Data - 22:09 How I got an androgynous voice out of a TTS that only offers two poles Claude Code's 25,000-token MCP limit let a 49,964-token result through. We measured both checks