Cisco Talos has identified a new autonomous Windows implant called CLOSEDQUORUM, which marks a significant evolution in malware architecture by utilizing "LLM-as-C2." Discovered through the CAIRN project, this 64-bit Go-based executable delegates tactical decision-making to a panel of commercial large language models, including DeepSeek, Qwen, Mistral, and Google Gemini. By using a plurality voting system to determine its next actions—such as credential theft, process injection, or persistence—the malware achieves "effort displacement," allowing it to operate independently of a human controller or traditional C2 infrastructure.
The technical capabilities of CLOSEDQUORUM are focused on harvesting user credentials and crypto wallets through techniques like LSASS memory dumping and browser data extraction. It leverages direct Windows system calls and employs multiple persistence mechanisms, including WMI event subscriptions and scheduled tasks. Because the implant communicates with legitimate LLM provider endpoints rather than unique attacker-controlled domains, it poses a unique challenge for defenders who must shift focus from domain blocking to behavioral detection of anomalous AI-provider API traffic originating from unauthorized processes.
Top comments (0)