CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator
A malware implant treats commercial AI chatbot endpoints as its command-and-control infrastructure, no attacker server required
Analysis
Cisco Talos disclosed CLOSEDQUORUM on 2026-09-22, a 16.4MB, 64-bit Go-compiled Windows implant it calls, "to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control" (Cisco Talos, 2026-09-22). Instead of a dedicated attacker-operated server, its ModelOrchestrator component queries up to four commercial LLM providers (DeepSeek, Qwen, Mistral and Google Gemini) each cycle, with a system prompt instructing each model to "provide ONLY executable decisions" alongside host context (hostname, OS version, admin status) and the current target process. Each provider must respond with a fixed JSON schema naming one of four actions; interModelDiscussion() tallies the providers' decisions by plurality vote and executes the winner, discarding any malformed or off-schema response. On a tie, a hardcoded preference order settles it: "DeepSeek holds the deciding vote in any tie" (Cisco Talos, 2026-09-22), followed by Qwen and then Mistral; if every provider fails to return a usable decision, the implant sleeps and retries rather than falling back to a default action.
The four possible actions are steal (simultaneous LSASS memory dumping via SeDebugPrivilege and MiniDumpWriteDump, Chrome/Edge/Firefox saved-credential harvesting, and MetaMask/Exodus/Ethereum wallet data collection), inject (Early Bird APC injection into a suspended process by default, or PEB-walk process hollowing when a model selects that exploit type), persist (establishes three mechanisms: a Windows-Update-themed Registry Run-key value, a scheduled task, and a permanent WMI event subscription that fires a script every 60 seconds), and move, which has no handler in the public build. The implant suppresses ETW telemetry by overwriting EtwEventWrite with a single RET instruction (Cisco Talos, 2026-09-22). Every model decision, its stated reasoning, and staged or stolen data are relayed to the operator through a Discord webhook, with exfiltrated files AES-256-GCM encrypted, base64-encoded and posted in roughly 1,900-byte chunks at one-second intervals. Talos found the binary via CAIRN, an open-source research toolkit for tracking AI-integrated malware that it released the same day, and its static analysis is dated 2026-06-17, under a prior alias, BALZAK, that was renamed on 2026-07-03. Talos's CAIRN toolkit is not the autonomous exploitation engine also named Cairn that Gambit Security documented in a separate 2026 campaign against online retailers (Gambit Security, 2026-09-22). Talos states plainly "we do not have confirmation of in-the-wild deployment," though artifacts in the binary connect its developer to carding-forum postings dating back to 2025 (Cisco Talos, 2026-09-22). The publicly distributed build ships with placeholder API keys and a dummy Discord webhook, so Talos has not observed a complete end-to-end execution; Talos assesses the actual distribution model puts a developer generating a customised binary with an individual operator's credentials injected at compile time, meaning any live deployment would run on infrastructure Talos has not seen.
Talos frames the finding as evidence of "effort displacement": an entire phase of an intrusion handed to a model rather than merely AI-assisted tooling. The Hacker News, reporting on the disclosure, draws its own comparison to LAMEHUG, malware Ukraine's CERT-UA reported in July 2025 that asked an AI model to write commands for a task already set in its code, contrasting it with CLOSEDQUORUM asking the models to choose the task itself (The Hacker News, 2026-09-23). Talos adds that handing the decision to models introduces weaknesses: "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs all create failure modes and defensive opportunities"; of these, only the tie behavior is one it calls "fully deterministic" (Cisco Talos, 2026-09-22).
Cited evidence
exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.
CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets. It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.
DeepSeek holds the deciding vote in any tie
Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs all create failure modes and defensive opportunities.
The tie behavior is fully deterministic and biased toward DeepSeek.
Updates2
Talos calls CLOSEDQUORUM, "to our knowledge", the first publicly documented Windows implant to apply this model to tactical command and control; the superlative is Talos's hedged assessment. The 2026-06-17 date is that of Talos's static analysis, not of a build. Talos says only that the implant suppresses ETW telemetry by overwriting EtwEventWrite with a single RET instruction, and it adds a five-minute initial delay and randomized 5 to 15 minute polling intervals to evade short-lived sandbox analysis (Cisco Talos, 2026-09-22).
Talos does not call the implant's failure modes deterministic, and it does not present the sleep-and-retry response to total provider failure as a defender opportunity. Its list of weaknesses is "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs", which it says "all create failure modes and defensive opportunities"; the only behavior it calls "fully deterministic" is the tie-break, biased toward DeepSeek (Cisco Talos, 2026-09-22).
Sources3
Revision history
- Published 2026-09-24T0405Z-intel
- Correction 2026-10-11T1307Z-audit
2026-06-17 is the date of Talos's static analysis, not of the build; the ETW sentence went beyond Talos's description; the title stated Talos's 'to our knowledge' superlative as fact. The entry now rates the reporting as one Talos source, which The Hacker News relays, and maps the LLM-provider C2 channel and the sandbox-evasion polling delay. The Cairn name-collision note now names Gambit Security's engine, cites it and links that entry, instead of calling the overlap coincidental.
Changed: title body classification verification techniques references sources
- Correction 2026-10-20T0835Z-audit
Talos calls only the implant's tie-breaking fully deterministic, not its failure modes in general, and its list of weaknesses that give defenders an opening is provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas and dependence on commercial APIs; the sleep-and-retry fallback is behavior it describes, not one of them.
Changed: body evidence summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.