The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →CLOSEDQUORUM is a Windows implant whose analyzed design asks up to four commercial large language model (LLM) services to select its next action from a short, fixed menu. Cisco Talos reported the design on September 22, 2026, but did not confirm deployment in the wild or observe a complete end-to-end run: the publicly distributed build contained placeholder API keys and a dummy Discord webhook.
What CLOSEDQUORUM is—and what “autonomous” means here
CLOSEDQUORUM is a 16.4 MB, 64-bit Windows executable compiled in Go, according to Cisco Talos. Talos describes it as, to its knowledge, the first publicly documented Windows implant to use commercial LLMs for tactical command-and-control (C2) decisions. That is Talos’s qualified characterization, not a universal priority claim.
As an Amazon Associate I earn from qualifying purchases.
In this design, “autonomous” means that the implant’s decision loop asks external models which of several predefined actions to route to. It does not mean the models invent arbitrary commands or that AI supplies the malware’s capabilities. The action handlers are built into the implant; the models provide a selection layer.
How the model vote is designed to work
- Collect host context. The implant gathers the hostname, operating-system architecture, CPU count, Windows version, and whether it has administrator status.
- Query providers in sequence. It can ask DeepSeek, Qwen, Mistral, and Google Gemini, supplying the collected context. Talos reports that the binary’s system prompt says, “You are an advanced malware strategist. Provide ONLY executable decisions.”
- Compare structured decisions. The implant tallies model responses by plurality. If responses tie, provider order breaks the tie: DeepSeek, then Qwen, then Mistral, then Gemini.
- Route to a built-in handler. The decision field is limited to four named choices:
steal,inject,persist, ormove. If all queried models fail, the reported fallback isconsensus; that choice has no capability handler in the analyzed build, so the implant sleeps and retries.
This makes the voting mechanism a C2 decision path, not a general-purpose AI operator: models choose among labels, while the binary determines what each implemented label does.
#1 Best Overall
What the four decisions do in the analyzed build
| Decision | Reported behavior |
|---|---|
steal |
Invokes collection of LSASS data, browser credentials, and cryptocurrency wallets. |
inject |
Selects between the implant’s injection routines. |
persist |
Invokes persistence mechanisms. |
move |
No handler was present in the distribution build Talos analyzed. |
consensus |
Fallback when all queried models fail; no capability handler was present, so the implant sleeps and retries. |
The missing move handler is a concrete limit of the analyzed distribution build. It should not be treated as evidence that lateral movement was observed or that every possible build has identical behavior.
What is—and is not—known about real-world activity
Talos’s static analysis confirmed the decision-loop design, and development builds showed provider credentials being injected at build time. But the public distribution sample had placeholder API keys and a dummy webhook. Talos therefore did not observe the complete architecture running end to end, and it reported no confirmed in-the-wild deployment.
That boundary matters: the disclosed sample supports conclusions about intended architecture and available code paths, not claims that victims were infected, that a live campaign used the implant, or that the full multi-model vote was dynamically demonstrated. Talos also linked artifacts in the binary to a developer associated with carding-forum posts dating to 2025; that context does not establish deployment or victimization.
Recommended Free Tools
How this differs from conventional C2
| Dimension | Conventional operator- or server-tasked C2 | CLOSEDQUORUM as reported by Talos |
|---|---|---|
| Decision source | An operator or command server directs tasks. | External LLM APIs are queried to select from the implant’s named decisions. |
| Infrastructure dependency | Depends on its command-and-control channel. | Adds access to multiple model-provider APIs as a decision-path dependency; Talos also reports Discord webhook reporting. |
| Action space | Depends on the commands and capabilities implemented by the malware. | Still constrained by fixed handlers in the binary; the model vote does not create new capabilities. |
| Human involvement | May involve an operator choosing or issuing tasks. | The reported loop delegates a tactical choice to model responses, but Talos’s sample did not demonstrate a full live run. |
| Operational evidence | Varies by campaign and sample. | No in-the-wild deployment was confirmed for CLOSEDQUORUM in Talos’s report. |
Using model APIs does not remove the need for initial access, malware capabilities already present on the host, or infrastructure to report or move stolen data. It changes one part of the decision process, not the rest of the intrusion lifecycle.
Rank #3
What defenders can monitor
Talos recommends correlating behaviors rather than treating any single indicator as proof. Legitimate software may contact AI providers, so a provider domain alone is not enough. More useful is a suspicious Windows process showing several related behaviors in the same activity window:
- Unexpected API traffic to multiple LLM providers from an executable that has no clear business reason to use them.
- LSASS access or other credential-collection behavior.
- Process-injection activity or creation of persistence mechanisms.
- Discord webhook communications associated with the same endpoint or process chain.
- Repeated polling at randomized intervals of roughly five to fifteen minutes, as described by Talos.
Because provider traffic uses TLS, the prompt content may only be visible through TLS inspection or provider-side telemetry. Blocking LLM domains alone is not a complete defense: it may disrupt this decision path, but it does not establish that no other capabilities or communications are present.
Talos says CLOSEDQUORUM was discovered through CAIRN, its open-source research toolkit for tracking AI-integrated malware, released alongside the disclosure. Defenders and researchers can consult Talos’s CLOSEDQUORUM analysis for the report and its CAIRN resource.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
