Cisco Talos Unveils CLOSEDQUORUM, an Autonomous AI-Driven Malware

Executive Summary

Cisco Talos has published research on a novel Windows malware implant, dubbed CLOSEDQUORUM, which represents what is believed to be the first publicly documented instance of malware using a panel of commercial Large Language Models (LLMs) for command and control (C2). This Go-based malware is designed to operate autonomously after deployment, removing the need for a human operator and traditional C2 infrastructure. It queries a 'quorum' of four AI models—Google Gemini, DeepSeek, Alibaba's Qwen, and Mistral—to determine its next action, which includes credential theft, code injection, and persistence. The sample analyzed contained placeholder API keys, suggesting it is a malware kit being sold to other criminals, and there is no evidence of its use in live attacks yet.

Threat Overview

CLOSEDQUORUM marks a significant evolution in malware design, shifting from static, human-driven commands to dynamic, autonomous decision-making powered by AI. After initial infection, the 16.4MB binary periodically (every 5-15 minutes) queries the four hardcoded LLMs. It provides them with the current host state and a system prompt instructing them to act as an "advanced malware strategist." The LLMs are constrained to choose from a predefined set of actions. The malware tallies the 'votes' from the AI panel and executes the majority decision, with the DeepSeek model acting as a tie-breaker. This decentralized, consensus-based C2 mechanism makes the malware resilient to the takedown of any single AI service and harder to predict.

Technical Analysis

• C2 Mechanism: The core innovation is the use of multiple commercial LLM APIs as a distributed C2 channel. This is a novel implementation of T1102 - Web Service. The malware sends host state information and receives one of four commands.
• Actions on Objectives: The AI-directed actions include:
  1. Credential Access: Stealing credentials from Windows process memory, likely using techniques similar to T1003 - OS Credential Dumping, and from browsers like Chrome, Edge, and Firefox (T1555.003 - Credentials from Web Browsers).
  2. Cryptocurrency Wallet Theft: Searching for and stealing files associated with crypto wallets like MetaMask and Exodus (T1552.001 - Credentials In Files).
  3. Defense Evasion & Privilege Escalation: Injecting code into running processes, a technique known as T1055 - Process Injection.
  4. Persistence: Establishing persistence through methods like creating scheduled tasks (T1053.005 - Scheduled Task/Job: Scheduled Task).
• Exfiltration: Stolen data is exfiltrated using Discord webhooks, a common abuse of a legitimate service (T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage).

To aid in the detection of similar threats, Talos has released an open-source toolkit called CAIRN (Cognitive Artifact Intelligence Research Network), which helps researchers hunt for AI-integrated malware.

Impact Assessment

While CLOSEDQUORUM has not been observed in the wild, its architecture represents a significant threat. Autonomous malware reduces the operational burden on attackers, allowing them to scale campaigns more effectively. The use of commercial LLM APIs for C2 makes attribution and takedown more difficult, as traffic blends in with legitimate API calls. If deployed successfully, this type of malware could react dynamically to a target environment without human intervention, potentially bypassing static defenses and responding to security measures in real-time. The sale of this as a kit could put sophisticated, autonomous attack capabilities into the hands of less-skilled threat actors.

Cyber Observables — Hunting Hints

The following patterns could indicate activity related to CLOSEDQUORUM or similar AI-driven malware:

Detection & Response

1. Egress Traffic Filtering: The most effective control is to restrict and monitor outbound web traffic. By default, deny connections to commercial LLM APIs and services like Discord from servers and non-essential workstations. Create explicit allow rules for legitimate use cases. This is a core tenet of Outbound Traffic Filtering.

2. API and DNS Query Logging: Log all DNS queries and web proxy traffic. Hunt for patterns of requests to multiple LLM API domains (generativelanguage.googleapis.com, api.mistral.ai, api.deepseek.com, etc.) from a single host in a short time frame. This aligns with Network Traffic Analysis.

3. Process Monitoring: Use an EDR solution to monitor for suspicious process behavior. A Go binary that does not have a legitimate business purpose and is observed performing credential dumping, process injection, or making outbound connections to LLM APIs should be immediately investigated. This is an example of Process Analysis.

Mitigation

1. Application Allowlisting: Implement application allowlisting to prevent the execution of unauthorized binaries, such as a novel Go-based implant. This is a form of Executable Allowlisting.

2. Credential Access Protection: Employ modern credential protection mechanisms like Windows Credential Guard to make it more difficult for malware to dump credentials from memory. Enforce MFA on all critical accounts to mitigate the impact of stolen credentials.

3. AI Governance Policy: Establish a clear corporate policy on the use of generative AI tools. Use security tools to discover and control the use of these services, blocking access where necessary and monitoring data flows to prevent sensitive information from being sent to external models.