#CLOSEDQUORUM

CLOSEDQUORUM malware outsources automated Windows C2 decisions to a council of LLMs

Threat researchers at Cisco Talos have uncovered a new Windows malware implant named CLOSEDQUORUM that replaces traditional command and control infrastructure with queries to commercial large language models. Once resident on an infected host, the malware queries up to four distinct AI model APIs—specifically DeepSeek, Alibaba's Qwen, Mistral, and Google Gemini—to determine its next tactical step. The implant sends system information describing the host state to each model, prompting them to vote on one of four hardcoded actions: steal, inject, persist, or move. Executing the steal routine triggers memory dumping for Windows credentials, pulling saved passwords from Chrome, Edge, and Firefox, and harvesting crypto wallets like MetaMask and Exodus. The persist routine leverages standard Windows Registry modifications, scheduled tasks, and Windows Management Instrumentation event subscriptions, while the inject routine injects code into active processes. Interestingly, the move routine was entirely unimplemented in the analyzed sample, leaving lateral movement functionality incomplete. In the event of a tied vote among the queried models, the implant's logic uses the first responding model as the tiebreaker, which defaulted to DeepSeek in the examined build. Talos noted that the analyzed artifact was an inert template binary containing placeholder API keys and a dummy Discord webhook, meaning researchers did not observe active live-victim infections. The operational appeal for attackers lies in avoiding bespoke C2 server hosting, as all outbound traffic simply blends into legitimate API queries to common commercial AI vendors. This finding aligns with a broader trend of experimental AI malware tooling, following prior research into artifacts like NYU's PromptLock, Google-tracked LameHug and PromptFlux, and Microsoft's documented SesameOp backdoor.