Windows CLOSEDQUORUM malware autonomously selects post-compromise actions via AI
First documented Windows implant using LLMs for command-and-control decisions.
1AI-powered command decisions
CLOSEDQUORUM queries four LLMs (Gemini, DeepSeek, Qwen, Mistral) to autonomously select post-compromise actions without human intervention. The malware uses a voting system where DeepSeek breaks ties. This represents the first documented case of a Windows implant using AI models for command-and-control decisions, according to Cisco Talos. The binary executes predefined actions like credential theft and cryptocurrency wallet extraction based solely on AI judgments.
2Attack automation advantages
By transferring decision-making to AI systems, CLOSEDQUORUM eliminates human bottlenecks in attack execution. Unlike human operators constrained by attention spans and working hours, the AI-driven malware can operate continuously. This 'effort displacement' potentially increases both the speed and scale of intrusions. The system only allows executable decisions, with models acting as 'advanced malware strategists' within strict operational boundaries defined in the malware's programming.
3Operational modules
The malware's capability modules include Steal (dumping LSASS memory, browser passwords, crypto wallets), Inject (shellcode execution via process hollowing), and Persist (maintaining device access). Each operator receives a customized executable containing their Discord webhook and LLM API keys injected at compile time. Stolen data gets AES-256-GCM encrypted with daily rotating keys derived from message timestamps, landing in operator-controlled Discord channels.
4Discovery methodology
Talos uncovered CLOSEDQUORUM using their new CAIRN toolkit designed specifically for hunting AI-integrated malware, now available as open source. While no in-the-wild deployments have been observed, forensic artifacts link the developer to criminal forum postings dating back to 2025. The malware is written in Go and represents a novel approach to autonomous attack execution through AI decision-making.
5Detection challenges
Traditional domain blocking proves ineffective against CLOSEDQUORUM since it contacts legitimate services like DeepSeek and Discord. Talos recommends behavioral monitoring for processes that simultaneously access multiple LLM APIs while performing suspicious activities like LSASS memory access or process injection. The malware's use of standard services makes signature-based detection particularly challenging.
6LLM voting mechanism
The malware implements a structured decision-making process where four AI models independently vote on next actions. If votes tie, DeepSeek's decision takes precedence, followed by Qwen, Mistral, and Gemini in that order. This quorum system ensures continuous operation without human oversight, with the binary executing only actions that receive clear AI consensus as being executable.
7Targeted data theft
CLOSEDQUORUM specifically targets Windows credentials, browser passwords (Chrome, Edge, Firefox), and cryptocurrency wallets (MetaMask, Exodus, Ethereum). The simultaneous execution of multiple theft commands demonstrates sophisticated data harvesting capabilities. The malware's focus on financial and authentication data suggests operators prioritize monetizable information over other potential targets.
8Security implications
CLOSEDQUORUM represents a paradigm shift in malware design by incorporating AI decision-making. Its autonomous nature could enable attacks at unprecedented scale and speed while reducing attacker exposure. The open sourcing of CAIRN aims to help security teams combat this emerging threat class. As AI-integrated malware evolves, defenders must develop new behavioral detection strategies beyond traditional indicators.