Cisco Talos has documented CLOSEDQUORUM, a 64-bit Windows implant that uses up to four commercial Large Language Models (LLMs) to decide its next action instead of relying on a dedicated attacker-controlled Command-and-Control (C2) server.
In a Sept. 22 analysis, Talos said the implant is, to its knowledge, the first publicly documented Windows example of this approach.
“CLOSEDQUORUM is best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift toward attack-chain automation is coming,” Talos wrote.
The Go-built implant consults DeepSeek, Qwen, Mistral, and Google Gemini one after another. Each model picks one of four permitted actions, and the option with the most votes wins, with DeepSeek breaking any tie.
A vote to steal makes the implant dump credentials from LSASS memory, collect saved Chrome, Edge, and Firefox passwords, and take MetaMask, Exodus, and Ethereum wallet data. It can also inject into processes and set persistence, though the “move” option has no handler in the distributed build.
The winning decision, the models’ explanations, and any stolen data are sent to the operator over a Discord webhook, encrypted with a key built from the current date. Talos noted that the developer could therefore, in theory, read any operator’s stolen data.
Talos did not observe a complete end-to-end execution. The version it examined carries no working API keys or webhook address, so it cannot run in its distributed form, and Talos has not confirmed deployment in the wild.
Artifacts in the binary did link its developer to carding posts on criminal forums dating back to 2025, and Talos assesses the implant is offered as a service, with a custom build for each buyer.
Behavior, Not Infrastructure, Is What Defenders Can See
Without a dedicated C2 server to block, Talos advised watching for several signals appearing together. An unexpected Windows executable contacting an AI provider, then several providers in a short period, matters more when the same process also accesses LSASS or injects into other processes.
Discord webhook traffic and execution at randomized five- to 15-minute intervals add context. No single signal identifies the implant, Talos cautioned, since legitimate software can use AI providers or Discord independently.
The design also creates weak points. Model refusals, rate limits, malformed responses, and provider outages can leave the implant without a usable decision.
“The advantage for defenders is that this progression is still only beginning,” the security company said. “We have an open window to study this transition, with the aim of developing the detections, controls, and response strategies needed before autonomous operations become more capable and widespread.”
