Cisco Talos has documented CLOSEDQUORUM, a Windows implant that asks a panel of commercial large language models what to do next and then does it. There is no attacker-operated server issuing tasking. The malware gathers host context, sends it to up to four LLM providers (DeepSeek, Qwen, Mistral, and Google Gemini), tallies their votes, and executes whichever action wins. This analysis draws on reporting from Cisco Talos.

CAIRN is the other half of the story. It is the open-source research toolkit Talos released for tracking AI-integrated malware, and CLOSEDQUORUM is the first finding published from it. Talos is clear about the evidence boundary: static analysis confirmed the full autonomous decision loop, and development builds show API credentials injected at compile time, but there is no confirmation of in-the-wild deployment. Artifacts in the binary did link the developer to criminal forum postings related to carding going back to 2025.

Conventional malware polls a fixed C2 server for instructions. That server has a domain, an IP, and a listener, which means your defenders can block it, and threat intelligence feeds can publish it. CLOSEDQUORUM removes that anchor by routing its decision-making through API endpoints that thousands of legitimate applications contact every day.

The capability demonstrated is narrow and worth describing accurately. The models do not write new code or invent tactics. They pick from four hardcoded options (inject, persist, steal, move) and supply parameters, and move has no handler at all in the distribution build.

The publicly observed sample is also inert. All LLM keys initialize to dummy_api_key and the Discord webhook to dummy_webhook_url, so Talos never watched a complete end-to-end run. What matters for your organization is the architecture, not this specific 16.4MB Go binary: tactical attack logic encoded as model-readable context, with structured model output converted directly into execution.

How the Implant Makes Its Own Tasking Decisions

The decision loop starts before any network traffic. gatherSystemInfo() runs during initialization and captures hostname, OS architecture, CPU count, Windows version, and administrator status. Those values are stored in the orchestrator and substituted into a TARGET: %s field in every prompt the implant sends.

The host details stay static across the run, while a target_process value refreshes each cycle. The system prompt recovered from the binary is short and blunt: "You are an advanced malware strategist. Provide ONLY executable decisions." The per-execution template then enumerates the choices available to the model.

Requests go out through main.queryLLM(model, prompt) inside a while (uVar16 < 4) loop driven by the ModelOrchestrator. Responses land in a []LLMDecision slice and are resolved by interModelDiscussion() using plurality voting, where each returned Decision value increments a map[string]int counter.

Tie handling is deterministic and worth understanding. The max-finding loop walks the slice in submission order with a strict less-than comparison, so the first maximum encountered wins. That gives DeepSeek the deciding vote, then Qwen, then Mistral, then Gemini if earlier providers dropped out.

Error handling is thin but functional. Malformed JSON, refusals, and timeouts are discarded rather than retried individually, and if every provider fails the fallback value is the string consensus, which maps to no capability handler. The loop sleeps and tries again instead of defaulting to an action, which means a blocked or rate-limited API turns the implant into a dormant process on your endpoint rather than an aggressive one.

Four decision values route into code. steal fires lsassDump(), dumpBrowserCredentials(), and extractCryptoWallets() simultaneously. inject calls generateShellcode() and then branches on the exploit_type field, sending process_hollow to injectProcess() for PEB-walk hollowing (T1055.012) and everything else to earlyBirdInject(), an APC injection routine using NtQueueApcThread (T1055.004). persist dispatches to establishPersistence(). The fourth value, move, has no handler in the distribution build at all.

That last gap matters for how you read this sample. The model can vote for lateral movement, and the binary will simply do nothing with the result. Talos is explicit that the distribution build ships with dummy_api_key and dummy_webhook_url values, so no end-to-end execution was observed. The confirmed portion is the static picture.

Ghidra decompilation supplied most of that picture. The import summary shows CGO_ENABLED=1, confirming the 16.4MB, 64-bit Go executable mixes Go and C to make direct Windows system calls, and the binary is unstripped, leaving DWARF function names like main.interModelDiscussion and main.sendToDiscord readable.

Post-decision behaviour leaves ordinary artifacts. Credential dumping enables SeDebugPrivilege and calls MiniDumpWriteDump against LSASS (T1003.001). Collected material stages under C:\Windows\Temp\, gets AES-256-GCM encrypted with a key derived from the current date, base64 encodes, then posts to Discord in 1,900-byte segments at one-second intervals.

Persistence runs three ways: a WindowsUpdate value under the user Run key, a scheduled task via schtasks.exe, and a permanent WMI event subscription firing every 60 seconds that writes and runs C:\Windows\Temp\wmi.ps1. The implant also overwrites EtwEventWrite with a single RET to suppress ETW telemetry, waits five minutes before its first action, and polls at randomized 5 to 15 minute intervals.

Why Model-Driven C2 Breaks Existing Detection Assumptions

Detection programs are built on three assumptions: malware talks to infrastructure you can block, it beacons on a rhythm you can profile, and the same family behaves the same way on every host. CLOSEDQUORUM breaks all three at once, which is why it is worth your attention even without confirmed in-the-wild deployment.

Start with egress. The implant's tasking traffic goes to commercial AI provider endpoints and its exfiltration goes to a Discord webhook. If your allowlist already permits developer tooling, chat platforms, and model APIs, this traffic sits inside the category you have deliberately approved. Blocking the destination means blocking services your own staff use daily, so the usual "add the domain to the denylist" response is not available to you.

Hash-based blocking degrades for a different reason. Talos assesses that the developer compiles a custom executable for each operator, with that operator's webhook and provider API keys injected at build time. Six distinct SHA256 hashes came out of a seven-day development window alone. Every operator you encounter carries a different binary, so an indicator feed entry from someone else's incident may never match the file sitting on your endpoint.

The scoping problem is the one that costs you the most hours. The action taken on each cycle is chosen by a model panel that receives slightly different host context each time, so the same malware on two of your machines can produce genuinely different behaviour. One host may show LSASS access through MiniDumpWriteDump, browser credential collection from Chrome, Edge, and Firefox, and wallet file theft, all triggered together by a single steal verdict. Another may show only registry Run key persistence under a WindowsUpdate value, or a scheduled task created through schtasks.exe, with no credential access at all.

That variability changes how you answer the question your executives and your regulators will ask. You cannot reason from one infected host to the rest of the estate, because divergent behaviour is the expected output of the architecture. Each machine needs individual examination, which extends investigation timelines and increases the forensic labour you pay for. Breach notification decisions get harder too, since "credentials were taken here" does not establish what happened three cubicles over.

Your telemetry is also thinner than usual during that investigation. The implant overwrites EtwEventWrite with a single RET instruction, suppressing Event Tracing for Windows output that many endpoint products rely on. Staged data lands under C:\Windows\Temp\, and a WMI persistence path writes a script consistent with C:\Windows\Temp\wmi.ps1, so on-disk artifacts remain even where process telemetry does not.

There is a governance consequence you should register now. Your AI service usage policy has become a security control surface. If nobody in your organisation can say which hosts should be talking to model provider APIs, then that traffic carries no signal for you, and an implant using those endpoints for tasking blends into an approved category.

Keep the maturity in perspective. The public build ships with placeholder credentials, the move decision has no handler at all, and tie-breaking is deterministic and biased toward one provider. The significance here is directional. A bounded phase of an intrusion ran without an operator, using ordinary commercial APIs, and the detection assumptions that broke will break again for the next implant built this way.

Detecting AI-Assisted Implants in Outbound Traffic

Start with your egress logs. Pull the last 90 days of proxy, DNS, and firewall records for api.deepseek.com, api.mistral.ai, and openrouter.ai, then join that list against your asset inventory. Any hit from a domain controller, file server, hypervisor host, or OT segment is worth a same-day investigation, because those machines have no legitimate reason to query a model provider.

Identify

Build a written list of which systems are permitted to reach AI APIs and which are not. Most organizations find the permitted set is a small group of developer workstations and a handful of application service accounts. Everything outside that set becomes an alerting condition, which gives you a detection rule that does not depend on knowing the malware family.

Inventory your AI API keys at the same time. Keys issued to individuals, embedded in scripts, or shared across teams cannot be revoked cleanly when one is abused, and CLOSEDQUORUM's build model compiles provider credentials directly into each operator's executable.

Protect

Route AI API traffic through an authenticated egress proxy so requests carry an identity you can attribute. Where TLS inspection is feasible on that path, prompt bodies containing host context or capability language become visible, which is otherwise only available through provider-side telemetry. Separately, restrict cdn.discordapp.com and Discord webhook POSTs to the browsers and approved apps that need them, since the implant uses that channel for both exfiltration and real-time action reporting.

Detect

Tune your EDR on behaviour chains, not hashes, because the developer produces a distinct binary per operator. The combinations worth alerting on:

• A process enabling SeDebugPrivilege and calling MiniDumpWriteDump against LSASS, then writing to C:\Windows\Temp\
• Creation of a permanent WMI event subscription paired with a script at C:\Windows\Temp\wmi.ps1 executed by powershell.exe
• A WindowsUpdate value written to the current user's Registry Run key, or a scheduled task created via schtasks.exe by a non-installer process
• Repeated outbound POSTs of base64 blocks sized to 1,900-byte segments at one-second intervals
• In-memory patching of EtwEventWrite with a single RET instruction

That last one matters most for telemetry integrity. In environments Capstone manages, SentinelOne flags ETW suppression and LSASS access attempts at the endpoint, so the loss of Windows event tracing does not also mean the loss of your detection signal.

Deploy the Talos YARA rule CLOSEDQUORUM_LLM_Autonomous_Implant to your file-scanning and retro-hunt pipelines. The DWARF symbol conditions (main.ModelOrchestrator, main.interModelDiscussion, main.earlyBirdInject) match unstripped Go builds directly, and the six published SHA256 hashes cover the developer's seven-day build chain.

Respond

If you confirm a match, treat every credential cached on that host as compromised, including domain accounts held in LSASS memory and saved browser logins. Capture the staging directory and the encrypted Discord payloads before reimaging, since the AES-256-GCM key derives from the message date and the exfiltrated set can be reconstructed during investigation. Force password resets and revoke any AI provider keys reachable from the host.

Recover

Rebuild affected endpoints rather than cleaning them, given multiple persistence mechanisms run in parallel. Then convert the incident into a baseline: record normal per-host AI API call volume and destination count, and write detections that tolerate randomized intervals instead of fixed beacon periods.

What to Prioritise Following the CLOSEDQUORUM Disclosure

Talos has no confirmation that CLOSEDQUORUM was ever deployed against a real target. The publicly available build is an inert template with placeholder credentials, and the six SHA256 hashes released cover a developer's build chain across seven days of work. What you are looking at is a working demonstration, not an active campaign you need to run to ground.

The distribution model is the part worth carrying forward. The developer compiles a customised 16.4MB Go executable for each operator, with provider API keys and the exfiltration webhook injected at compile time, and the operator handles delivery independently. Every buyer therefore gets a distinct binary and a distinct collection channel, which limits how much value file hashes will give you. Artifacts from the binary also tied the developer to criminal forum postings on carding going back to 2025, so the commercial interest behind it is ordinary credential theft.

The architecture has real weaknesses you can plan around. Provider refusals, rate limits, malformed model output, a tie-break that is fully deterministic and biased toward DeepSeek, and total dependence on commercial APIs all give the implant failure modes that a traditional operator-run listener does not have.

That dependence points to your one priority: knowing which of your hosts can reach commercial model provider APIs, and deciding which of them should. This class of implant cannot task itself without that path. Everything else in the chain, the injection routines, the LSASS access, the staged files, is familiar work your existing tooling already understands.