New ClosedQuorum malware uses AI panel to autonomously decide attack actions

A new strain of Windows malware dubbed ClosedQuorum marks what researchers say is the first publicly documented case of an implant that delegates tactical command-and-control (C2) decisions to a panel of artificial intelligence models. Discovered by Cisco Talos through its open-source CAIRN toolkit, the malware integrates Google Gemini, DeepSeek, Qwen, and Mistral to determine the next step after compromising a host.

“The models are restricted to a predefined set of decisions,” Cisco Talos explained in a blog post. Those decisions include “steal” (simultaneously running LSASS credential dumping, browser credential theft from Chrome, Edge, and Firefox, and cryptocurrency wallet extraction from MetaMask, Exodus, and Ethereum), “inject” (generating shellcode and using process hollowing or Early Bird APC injection), “persist” (executing the persistence module), and “move” (lateral movement, though the analysed build lacks a handler for this action).

When votes among the four AI models are tied, DeepSeek has priority in making the final call, followed by Qwen, Mistral, and then Gemini. The stolen information is then passed to the operators via a Discord webhook, meaning that beyond the initial malware delivery, the attack can be fully automated without human interaction.

Cisco Talos notes that while this automation adds speed and scaling potential to malicious operations, it also introduces challenges: the system may face rate limits on commercial AI APIs, malformed output, or temporary unavailability of the AI services it relies on. The researchers added that the binary they analysed contained placeholder API credentials and a dummy Discord webhook, though the creators could supply real credentials in custom builds.

It remains unclear whether ClosedQuorum is being actively deployed in the wild or is an experimental test. However, Cisco Talos warned that it represents an “architectural shift towards attack-chain automation.” Artifacts from the binary linked the developer to postings on criminal forums related to carding dating back to 2025. Cisco Talos discovered the malware through CAIRN, an open-source toolkit it released to help researchers track and analyse AI-integrated malware.

Why This Matters

ClosedQuorum demonstrates a new tier of automation in malware, where post-compromise decisions are made by AI models rather than human operators, potentially allowing attacks to scale faster and operate around the clock.
The use of multiple commercial AI models (Google Gemini, DeepSeek, Qwen, Mistral) creates a dependency on third-party APIs that could become attack surfaces themselves, or cause operational failures if APIs are rate-limited or unavailable.
Even if this specific malware is only a test, it signals an architectural trend: future malware may increasingly offload tactical reasoning to AI, making detection and response more challenging for defenders.

Background

Malware has historically relied on hardcoded logic or remote command-and-control servers where human operators issue instructions. Automated decision-making has been limited to simple rule-based triggers. ClosedQuorum breaks that pattern by using multiple large language models in a voting system to choose among predefined actions. This is the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of AI models, according to Cisco Talos. The discovery was made through the CAIRN (Cognitive Artifact Intelligence Research Network) toolkit, an open-source project Cisco released to help researchers identify and track AI-integrated malware.

Key Perspectives

Cisco Talos (researchers): They view ClosedQuorum as an “architectural shift” that eliminates human interaction from the post-compromise stage, increasing the speed and scaling potential of attacks. They caution that while the current sample appears experimental, the concept could be adopted by more sophisticated threat actors. Critics/Skeptics: The malware relies on commercial AI APIs that introduce single points of failure — rate limits, malformed outputs, or service outages could halt an attack. Moreover, the decisions are limited to a small set of predefined options, and the analysed build cannot execute lateral movement, suggesting limited practical capability at this stage. It may be a proof-of-concept rather than a mature threat.

What to Watch

Whether active ClosedQuorum builds appear in the wild with valid API keys and real Discord webhooks, indicating operational deployment.
Adoption of the voting-system pattern by other malware families, especially ransomware groups that could use AI to dynamically choose targets or evasion techniques.
Defensive countermeasures: AI-integrated malware may require new detection methods beyond static signatures, such as monitoring API calls to known AI model endpoints.

ZOTPAPER