Cisco Talos Finds Windows Malware That Lets Four LLMs Vote on Its Next Attack Step

TL;DR

CLOSEDQUORUM is a Windows implant that hands its command-and-control decisions to a panel of commercial LLMs. Cisco Talos published its analysis on September 22 and calls it the first publicly documented Windows implant to use this model for tactical C2. The binary collects basic host details, sends them to DeepSeek, Qwen, Mistral and Google Gemini, and runs whichever action wins a plurality vote: steal credentials, inject shellcode, or dig in for persistence. Talos found it with CAIRN, a new open-source toolkit for tracking AI-integrated malware. The caveat matters: the public build ships with placeholder API keys, and Talos has not confirmed any in-the-wild deployment.

What Talos actually found

Per Talos, CLOSEDQUORUM is a 16.4MB 64-bit Windows executable written in Go. It is not a chatbot bolted onto a stealer. The model panel replaces the person who would normally sit at a C2 console and decide what to do after the implant checks in.

At startup, a gatherSystemInfo() routine grabs the hostname, OS architecture, CPU count, Windows version and whether the process has admin rights. That profile goes to all four providers with a system prompt Talos extracted verbatim: "You are an advanced malware strategist. Provide ONLY executable decisions." Answers are constrained to a typed JSON schema, so each model returns one choice from a fixed menu instead of free-form advice.

The loop then repeats at randomized 5-15 minute intervals, per Talos. No operator has to be awake.

How the quorum works

Each of the four providers votes for an action. The implant tallies the votes and executes the one with the most, and BleepingComputer independently reports the same scheme. Ties are broken by a fixed provider order: DeepSeek first, then Qwen, Mistral and Gemini.

Think of it as a heist crew that can no longer afford a mastermind, so it phones four consultants and goes with the majority. The trick is not that any single model is a brilliant strategist. It is that a vote smooths over the odd refusal or garbage answer from one provider, which makes the system more reliable than betting on a single API.

Failure handling is telling. If every model fails, Talos says the fallback decision is the string consensus, which has no handler, so the implant simply sleeps and retries instead of taking a default action. Whoever wrote it cared more about not doing something dumb than about always doing something.

The action menu

The JSON schema only allows four choices, and one of them is a stub:

• steal: dumps LSASS memory via MiniDumpWriteDump, pulls saved passwords from Chrome, Edge and Firefox, and grabs MetaMask extension data plus Exodus and Ethereum wallet files.
• inject: process hollowing or Early Bird APC injection.
• persist: Registry Run keys (a value named WindowsUpdate, naturally), scheduled tasks via schtasks.exe, and WMI event subscriptions that fire every 60 seconds.
• move: lateral movement, which Talos says has no handler in the distribution build.

Exfil and the business model

Stolen material is encrypted with AES-256-GCM using a key derived from the current date, base64-encoded, split into 1,900-byte chunks and posted to an operator-controlled Discord webhook at one-second intervals, according to Talos. The same webhook also receives the winning action, the model reasoning and attack telemetry, per BleepingComputer.

The webhook URL and the LLM API keys are baked in at compile time, so each operator gets a distinct build. Talos describes this as a credentials-as-a-service model, and links the developer through binary artifacts to carding posts on criminal forums dating back to 2025. Six SHA256 hashes in the report cover the developer's build chain across seven days of development.

What it is not (yet)

Keep the hype in proportion. Talos states it does not have confirmation of in-the-wild deployment, and the publicly distributed binary carries non-functional placeholder credentials and a dummy webhook. A complete end-to-end run has not been observed. This is a documented architecture, not a documented outbreak.

The model's job is also narrow. The LLMs pick from four canned actions; they do not write novel exploits on the fly. The dangerous code (LSASS dumping, injection, persistence) is ordinary, well-known tradecraft. What changes is who decides when to run it.

Talos frames that as effort displacement: "not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system." For a low-skill carder, that is the whole pitch.

CAIRN: the hunting kit that found it

The other half of the release is CAIRN (Cognitive Artifact Intelligence Research Network), published under the MIT license. Per its README, it works entirely from VirusTotal metadata, with no binary downloads or detonation, and combines 27 named VT search channels, a three-tier YARA ontology, embedding-based clustering and an explorer UI over a SQLite corpus.

The README lists ten confirmed families, CLOSEDQUORUM among them alongside names like PROMPTLOCK, PROMPTFLUX, PROMPTSTEAL and LAMEHUG. It also defines an archetype taxonomy running from credential harvesting up to LLM-tasked C2, which is exactly the rung CLOSEDQUORUM occupies.

What builders and defenders should do

Talos's detection advice is behavioral, and one line from the report is worth taping to a monitor: "legitimate applications may contact [providers] independently. Far fewer should contact several of them while also accessing LSASS."

• Correlate LLM egress. One process hitting several model APIs within a short window is unusual on most endpoints. Treat it like any other rare outbound pattern.
• Pair it with host signals. LSASS access plus process injection plus Discord webhook traffic from an unexpected executable is a strong combination.
• Watch your own keys. This design runs on stolen or throwaway API keys. If you run an AI product, abuse detection on keys that suddenly emit strategy JSON for "malware strategists" is now a real use case.
• Load the IOCs. The six build-chain hashes are in the Talos post.

Key Takeaways

• CLOSEDQUORUM is a 16.4MB Go implant for Windows that lets DeepSeek, Qwen, Mistral and Gemini vote on its next post-compromise action.
• Ties go DeepSeek, then Qwen, Mistral, Gemini; if every model fails, it sleeps and retries instead of acting.
• Available actions are credential and wallet theft, shellcode injection and persistence; lateral movement is an unimplemented stub.
• No in-the-wild deployment is confirmed and the public build ships placeholder keys, so this is an architecture warning, not an outbreak.
• Talos also open-sourced CAIRN (MIT), a VirusTotal-metadata toolkit with 26 YARA rules and ten documented AI-integrated malware families.
• Best detection signal: one process talking to several LLM APIs while touching LSASS.

Sources: Cisco Talos: The Closed Quorum, CAIRN on GitHub, BleepingComputer