"CLOSEDQUORUM instead asks up to four commercial AI services what to do: DeepSeek, Qwen, Mistral, and Google Gemini," Cisco Talos reported on September 22, 2026.
How CLOSEDQUORUM hands control to AI models
CLOSEDQUORUM is a Windows implant that delegates command-and-control (C2) decisions to up to four commercial AI services rather than to an attacker-run server, Cisco Talos said. With each decision cycle the malware sends a short set of facts about the host — computer name, Windows version, and whether it has administrator privileges — and a fixed list of candidate actions. Each model must reply in a strict format; the implant discards any response that does not comply. The malware tallies the usable answers and performs the action with the most votes. If no model provides an acceptable reply, the implant waits and retries rather than choosing by default.
What the four choices do — steal, inject, persist, move
Talos described four actions that the models may select: steal, inject, persist, and move. In the examined public build the move option has no implementation and therefore does nothing. When steal is chosen, CLOSEDQUORUM simultaneously performs three data-exfiltration tasks: it dumps LSASS process memory to capture login credentials, extracts saved passwords from Chrome, Edge, and Firefox, and copies data from crypto wallet software including MetaMask, Exodus, and Ethereum wallets.
The inject option runs code inside another process, using Early Bird APC injection or, on request, process hollowing. The persist option establishes three startup mechanisms: a user Registry Run key value, a scheduled task, and a WMI permanent event subscription that launches the implant every 60 seconds. Talos noted the Registry and WMI artifacts use Windows Update–themed names to appear benign.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperational details and the attacker's experience
Each deployed copy requires API keys for the chosen AI services and a working Discord webhook URL for the attacker to receive decisions and stolen data. Talos observed that test and public builds contain placeholder API keys and webhook values, so the public samples cannot reach the models or exfiltrate data. Nevertheless, Talos said CLOSEDQUORUM is, to its knowledge, the first publicly documented Windows implant that hands C2 decisions to AI models.
Before executing an action the malware posts the models' votes and each model’s stated reason to a Discord channel via the webhook; stolen files are sent to the same channel. Stolen files are staged to C:\Windows\Temp\, encrypted, split into 1,900‑byte chunks, and posted at roughly one chunk per second to the Discord channel, Talos found.
Constraints and brittle dependencies of AI-driven control
Cisco Talos described several inherent weaknesses in relying on third-party AI services: providers can refuse requests, throttle or limit responses, or return malformed output. The approach also creates operational dependencies on companies the attacker does not control. Talos framed CLOSEDQUORUM as an early and limited example of attackers delegating part of an attack to models — a different pattern from prior threats such as LAMEHUG, which Ukraine’s CERT‑UA reported in July 2025 and which asked an AI model to author commands embedded in malware code. CLOSEDQUORUM instead asks models to choose from preexisting tasks.
Indicators defenders can hunt for
- Unusual AI-service traffic from a Windows program that would not normally use AI, especially when similar requests are sent to multiple providers in quick succession.
- Prompts containing host-specific details or attack language — likely visible only with TLS inspection or to the AI provider.
- Process injection, LSASS access, or new persistence mechanisms appearing alongside AI-service calls.
- Discord webhook traffic from the same program or host, and activity that repeats at random intervals of roughly five to 15 minutes.
- Specific on-host traces: a Registry value named WindowsUpdate under the current user's Run key; a PowerShell script at a path consistent with C:\Windows\Temp\wmi.ps1; and a permanent WMI event subscription using Windows Update–themed names that starts the program every 60 seconds.
Talos published a Snort rule (1:66984) that looks for the malware’s prompts to AI services, but noted matching that traffic typically requires TLS inspection. A YARA rule Talos released targets file scans in VirusTotal; the CAIRN rule bundle Talos published did not include a CLOSEDQUORUM rule when The Hacker News checked it on September 23, 2026, so defenders using CAIRN would need to add Talos’s rule manually.
What this means for technologists, incident responders, and enterprises
Technologists and security teams should prioritize behavioral detection: look for the uncommon combination of AI-service traffic plus memory dumps, browser wallet access, and process injection rather than trying to block AI provider domains outright. Incident responders will need to check for Windows Update–themed persistence artifacts and the PowerShell script path referenced above. Procurement and enterprise defenders should note that attackers will require valid API keys and webhook endpoints — a detail that can influence threat-hunting and detection priorities.
Talos published SHA‑256 hashes for six development builds to aid detection and analysis:
- 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7
- c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7
- c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f
- f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c
- 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb
- eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5
CLOSEDQUORUM represents an incremental shift: attackers experimenting with outsourcing decision logic to commercial models. The public samples are nonfunctional without real keys and a webhook, but the code dated June 17, 2026 shows the concept is already in active development — and defenders now have concrete detection leads to follow.
