CLOSEDQUORUM: Cisco Talos documents the first publicly reported Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator

Cisco Talos disclosed CLOSEDQUORUM on 2026-09-22, a 16.4MB, 64-bit Go-compiled Windows implant it says is "the first publicly documented Windows implant to apply this model to tactical command and control" (Cisco Talos, 2026-09-22). Instead of a dedicated attacker-operated server, its ModelOrchestrator component queries up to four commercial LLM providers (DeepSeek, Qwen, Mistral and Google Gemini) each cycle, with a system prompt instructing each model to "provide ONLY executable decisions" alongside host context (hostname, OS version, admin status) and the current target process. Each provider must respond with a fixed JSON schema naming one of four actions; interModelDiscussion() tallies the providers' decisions by plurality vote and executes the winner, discarding any malformed or off-schema response. On a tie, a hardcoded preference order settles it: "DeepSeek holds the deciding vote in any tie" (Cisco Talos, 2026-09-22), followed by Qwen and then Mistral; if every provider fails to return a usable decision, the implant sleeps and retries rather than falling back to a default action.

The four possible actions are steal (simultaneous LSASS memory dumping via SeDebugPrivilege and MiniDumpWriteDump, Chrome/Edge/Firefox saved-credential harvesting, and MetaMask/Exodus/Ethereum wallet data collection), inject (Early Bird APC injection into a suspended process by default, or PEB-walk process hollowing when a model selects that exploit type), persist (establishes three mechanisms, a Windows-Update-themed Registry Run-key value, a scheduled task, and a permanent WMI event subscription that fires a script every 60 seconds), and move, which has no handler in the public build. Independent of the LLM-selected action, the implant suppresses ETW telemetry by overwriting EtwEventWrite with a single RET instruction, blinding any host-side ETW consumer to its subsequent activity (Cisco Talos, 2026-09-22). Every model decision, its stated reasoning, and staged or stolen data are relayed to the operator through a Discord webhook, with exfiltrated files AES-256-GCM encrypted, base64-encoded and posted in roughly 1,900-byte chunks at one-second intervals. Talos found the binary via CAIRN, an open-source research toolkit for tracking AI-integrated malware that it released the same day, and dates the analysed build to 2026-06-17 under a prior alias, BALZAK, before it was renamed on 2026-07-03. Talos's CAIRN toolkit is unrelated to a similarly-named autonomous exploitation engine used in separate, unrelated 2026 campaigns; the shared name is coincidental. Talos states plainly "we do not have confirmation of in-the-wild deployment," though artifacts in the binary connect its developer to carding-forum postings dating back to 2025 (Cisco Talos, 2026-09-22). The publicly distributed build ships with placeholder API keys and a dummy Discord webhook, so Talos has not observed a complete end-to-end execution; Talos assesses the actual distribution model puts a developer generating a customised binary with an individual operator's credentials injected at compile time, meaning any live deployment would run on infrastructure Talos has not seen.

Talos frames the finding as evidence of "effort displacement", an entire phase of an intrusion handed to a model rather than merely AI-assisted tooling. The Hacker News, reporting on the disclosure, draws its own comparison to LAMEHUG, malware Ukraine's CERT-UA reported in July 2025 that asked an AI model to write commands for a task already set in its code, contrasting it with CLOSEDQUORUM asking the models to choose the task itself (The Hacker News, 2026-09-23). The implant's failure modes are deterministic and, Talos notes, exploitable by defenders: provider refusals and rate limits, a fixed tie-break order, and a sleep-retry response to total provider failure rather than a default action.