CLOSEDQUORUM malware outsources automated Windows C2 decisions to a council of LLMs
Threat researchers at Cisco Talos have uncovered a new Windows malware implant named CLOSEDQUORUM that replaces traditional command and control infrastructure with queries to commercial large language models. Once resident on an infected host, the malware queries up to four distinct AI model APIs—specifically DeepSeek, Alibaba's Qwen, Mistral, and Google Gemini—to determine its next tactical step. The implant sends system information describing the host state to each model, prompting them to vote on one of four hardcoded actions: steal, inject, persist, or move. Executing the steal routine triggers memory dumping for Windows credentials, pulling saved passwords from Chrome, Edge, and Firefox, and harvesting crypto wallets like MetaMask and Exodus. The persist routine leverages standard Windows Registry modifications, scheduled tasks, and Windows Management Instrumentation event subscriptions, while the inject routine injects code into active processes. Interestingly, the move routine was entirely unimplemented in the analyzed sample, leaving lateral movement functionality incomplete. In the event of a tied vote among the queried models, the implant's logic uses the first responding model as the tiebreaker, which defaulted to DeepSeek in the examined build. Talos noted that the analyzed artifact was an inert template binary containing placeholder API keys and a dummy Discord webhook, meaning researchers did not observe active live-victim infections. The operational appeal for attackers lies in avoiding bespoke C2 server hosting, as all outbound traffic simply blends into legitimate API queries to common commercial AI vendors. This finding aligns with a broader trend of experimental AI malware tooling, following prior research into artifacts like NYU's PromptLock, Google-tracked LameHug and PromptFlux, and Microsoft's documented SesameOp backdoor.
Commentary
The real story here is the shift in how threat actors handle C2 infrastructure resilience. By outsourcing the decision-making loop to public LLM API endpoints and exfiltrating over standard Discord webhooks, the operator eliminates the need to run, configure, and protect dedicated command-and-control servers. Traditional network defenders relying on IP or domain reputation will struggle because blocking outbound traffic to major providers like Google or Mistral breaks legitimate enterprise AI tooling. From a technical perspective, CLOSEDQUORUM is fairly primitive—it essentially functions as a majority-voting wrapper around classic post-exploitation tasks like dumping browser sqlite databases, hooking `lsass.exe` memory, and setting up WMI subscriptions. However, blue teams must adapt their telemetry. Defending against this requires inspecting process-level network behavior: an unsigned binary or anomalous host process opening outbound TLS connections to `api.deepseek.com` or OpenAI endpoints should trigger high-fidelity alerts. Additionally, security teams should implement centralized API gateway controls or egress proxies that require authenticated tokens for commercial LLM usage, effectively blinding unauthenticated implants trying to phone home.
The Quote to Remember
“CLOSEDQUORUM is best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming”