ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel

Key facts for ClosedQuorum AI voting malware

Detection coverage for ClosedQuorum AI voting malware

As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2621 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Correlated LSASS Credential Dumping and Scheduled-Task Persistence (SPL)

Detects the correlated combination of LSASS credential-memory access consistent with MiniDumpWriteDump and an schtasks.exe-created scheduled task on the same host within a short window. This matches CLOSEDQUORUM's LLM-selected 'steal' action (LSASS dump + browser/wallet credential theft via MiniDumpWriteDump) occurring alongside its 'persist' action (Registry Run key 'WindowsUpdate', schtasks.exe task, WMI event subscription polling ~60s).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1555.003, T1547.001, T1053.005, T1546.003, T1055.004, T1055.012
• Data sources: sysmon, windows_security, windows_registry, wmi_trace_log
• Severity: high
• Confidence: medium

Splunk SPL

index=windows (sourcetype="WinEventLog:Sysmon" EventCode IN (1,10)) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval technique=case(
    (match(Image,"(?i)rundll32\.exe") AND match(CommandLine,"(?i)comsvcs\.dll") AND match(CommandLine,"(?i)MiniDump")) OR (EventCode=10 AND match(TargetImage,"(?i)lsass\.exe") AND match(GrantedAccess,"0x1[0-9a-fA-F]{3}")), "T1003.001_lsass_dump",
    match(Image,"(?i)schtasks\.exe") AND match(CommandLine,"(?i)/create"), "T1053.005_scheduled_task",
    1=1, "other")
| where technique!="other"
| stats values(technique) as techniques_observed, dc(technique) as technique_count, earliest(_time) as first_seen, latest(_time) as last_seen by host, Computer, user
| where technique_count >= 2
| sort - technique_count

Microsoft KQL

let LsassAccess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "rundll32.exe" and ProcessCommandLine has "comsvcs.dll" and ProcessCommandLine has "MiniDump")
| project Timestamp, DeviceName, Technique = "T1003.001", InitiatingProcessFileName, AccountName;
let SchTask = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| project Timestamp, DeviceName, Technique = "T1053.005", InitiatingProcessFileName, AccountName;
union LsassAccess, SchTask
| summarize Techniques = make_set(Technique), TechniqueCount = dcount(Technique), Accounts = make_set(AccountName) by DeviceName, bin(Timestamp, 1h)
| where TechniqueCount >= 2

Sigma

title: Correlated LSASS Credential Dumping and Scheduled-Task Persistence
id: b2c3d4e5-2222-4b3c-9d4e-5f6071829304
status: experimental
description: Detects, on the same host within a short window, both an LSASS memory-dump technique (comsvcs.dll MiniDump export via rundll32.exe) and an schtasks.exe-created scheduled task. This matches the correlated credential-theft plus persistence chain documented for CLOSEDQUORUM's LLM-selected 'steal' and 'persist' actions; pair with registry (Run key named 'WindowsUpdate') and WMI event-subscription monitoring for full triad coverage.
references:
    - https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1555.003
    - attack.persistence
    - attack.t1547.001
    - attack.t1053.005
    - attack.t1546.003
    - attack.defense-evasion
    - attack.t1055.004
    - attack.t1055.012
detection:
    selection_lsass_dump:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains|all:
            - 'comsvcs.dll'
            - 'MiniDump'
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    condition: 1 of selection_*
logsource:
    category: process_creation
    product: windows
falsepositives:
    - Authorized incident-response/forensic LSASS memory acquisition tooling (procdump, Sysinternals) run by IT security staff
    - Legitimate software-deployment or IT-automation scripts creating scheduled tasks
level: high

Known false positives:

• Authorized IR/forensic memory acquisition tooling (procdump, comsvcs.dll MiniDump usage by security staff)
• Legitimate IT/software-deployment scheduled task creation via schtasks.exe

Tuning notes: Correlate this alert with a companion registry-monitoring rule for HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate and a WMI __EventFilter/__EventConsumer creation rule (~60s polling) to reconstruct the full persistence triad; exclude known EDR/backup agents that legitimately touch lsass.exe via documented allowlisted paths.

• 🔒 Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (KQL) · unlock with TL Creds
• 🔒 Correlated LSASS Credential Dumping and Scheduled-Task Persistence (KQL) · unlock with TL Creds
• 🔒 Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (KQL) · unlock with TL Creds
• 🔒 Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (Sigma) · unlock with TL Creds
• 🔒 Correlated LSASS Credential Dumping and Scheduled-Task Persistence (Sigma) · unlock with TL Creds
• 🔒 Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (Sigma) · unlock with TL Creds
• 🔒 Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (SPL) · unlock with TL Creds
• 🔒 Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (SPL) · unlock with TL Creds

Indicators of compromise for ClosedQuorum AI voting malware

As of 2026-09-22, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2621.

Sample indicators (3 of 19)

• Domain: api[.]deepseek[.]com
• File hash: 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7
• Domain: api[.]mistral[.]ai

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How ClosedQuorum AI voting malware works

Talos calls it the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of commercial LLMs; the analyzed build is a non-functional template with placeholder API keys, and Talos found no confirmed in-the-wild deployment, but binary artifacts tie the developer to 2025 carding-forum postings.

CLOSEDQUORUM is a 64-bit Windows implant written in Go with CGO enabled (CGO_ENABLED=1) and confirmed direct Windows syscalls, discovered by Cisco Talos and disclosed alongside the release of Talos's open-source CAIRN (Cognitive Artifact Intelligence Research Network) hunting toolkit on 2026-09-22. Rather than receiving tasking from a human operator or a traditional C2 server, the implant packages host-context telemetry (hostname, OS architecture, CPU count, Windows version, admin status, injected at runtime via a 'TARGET: %s' template) into a constrained system prompt ('You are an advanced malware strategist. Provide ONLY executable decisions.') and queries four commercial LLM providers in sequence: DeepSeek, Qwen, Mistral, and Google Gemini. Each model returns a typed JSON response constrained to a fixed decision schema (Decision, Reasoning, target_process, exploit_type, evasion_method, payload_config), and the implant selects the action chosen by a plurality of the four models. When votes tie, a fixed priority order resolves it: DeepSeek first, then Qwen, then Mistral, then Gemini; if all four model queries fail, the implant falls back to a 'consensus' state that causes it to sleep and retry.

The decision space is restricted to four options. 'Steal' simultaneously runs LSASS credential dumping via MiniDumpWriteDump, browser credential extraction from Chrome, Edge, and Firefox (targeting Login Data / logins.json stores), and cryptocurrency-wallet extraction from MetaMask, Exodus, and Ethereum wallet paths. 'Inject' generates shellcode and delivers it via one of two techniques: earlyBirdInject() (APC queuing into a suspended process) or process_hollow() (PEB-walk process hollowing with entry-point overwrite). 'Persist' installs a persistence triad: a Registry Run key disguised as a 'WindowsUpdate' value, a scheduled task created via schtasks.exe, and a WMI event subscription that re-triggers roughly every 60 seconds via a performance-counter query. 'Move' is present in the decision schema as a lateral-movement option, but the analyzed build has no corresponding handler and cannot execute it.

Stolen data is encrypted with AES-256-GCM using a key derived from the current date, then Base64-encoded and exfiltrated to the operator via a Discord webhook in ~1,900-byte segments transmitted roughly once per second. Talos characterizes the date-derived key as obfuscation rather than genuine key separation, since the developer can trivially recompute it.

Talos discovered the sample via CAIRN, a new open-source, metadata-only toolkit (no binary execution or download) that hunts for 'cognitive artifacts' of AI integration in malware — embedded prompt templates, LLM provider API endpoints, AI-sandbox evasion strings, local-model runtime indicators, and agentic tool-call syntax — using a three-tier YARA ontology (primitive artifact presence, behavioral context, confirmed operational family) plus embedding-based semantic clustering (UMAP/HDBSCAN) for pivoting across related samples. CLOSEDQUORUM is catalogued under CAIRN's archetype A4 ('LLM-Tasked C2'), and Talos cites LAMEHUG (first documented by CERT-UA in July 2025) as the earliest known precedent for AI-integrated malware.

The analyzed sample was a development/test build: it shipped with placeholder API credentials and a dummy Discord webhook, was statically analyzed by Talos on 2026-06-17, and carries a later binary-renaming artifact dated 2026-07-03. Talos found no confirmed in-the-wild deployment or evidence the autonomous loop has executed against a live target — the finding is static-analysis-only. However, artifacts recovered from the binary connected its developer to postings on criminal carding forums dating back to 2025, and Talos assesses the primary motivation as financial (credential and cryptocurrency theft). Talos researcher Ryan Fetterman described CLOSEDQUORUM as, to Talos's knowledge, 'the first publicly documented Windows implant to apply this model to tactical command and control,' and framed the disclosure as giving defenders 'an open window to study this transition' toward AI-delegated attack-chain automation before it reaches operational maturity.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1555.003 Credentials from Web Browsers

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Persistence

T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription; T1547.001 Registry Run Keys / Startup Folder

Defense Evasion

T1055.004 Asynchronous Procedure Call; T1055.012 Process Hollowing

Command and Control

T1102.002 Bidirectional Communication; T1573.001 Symmetric Cryptography

Exfiltration

T1567.004 Exfiltration Over Webhook

Remediation for ClosedQuorum AI voting malware

Immediate actions

• Monitor egress to LLM-provider API domains (api.deepseek.com, api.mistral.ai, openrouter.ai, and Google Gemini's generativelanguage.googleapis.com) from unexpected or non-browser processes -- Talos's CAIRN flags 'AI-provider API traffic from unexpected executables' and 'correlated requests to multiple model endpoints within short intervals' as a core detection signal for this malware class.
• Alert on Discord webhook/CDN traffic (discord.com/api/webhooks, cdn.discordapp.com) originating from non-Discord-client processes, especially repeated small POST bursts (~1,900 bytes at ~1-second intervals) consistent with CLOSEDQUORUM's segmented exfiltration.
• Enforce LSASS access hardening (Credential Guard / PPL for lsass.exe) to block MiniDumpWriteDump-based credential dumping used by the 'steal' action.

Workarounds

• Restrict outbound access from standard endpoints to consumer/commercial AI-provider APIs via egress allow-listing where no legitimate business use exists, rather than relying on blocklists against a class of legitimate infrastructure.
• Block or alert on Discord webhook domains at the network perimeter for host groups with no legitimate Discord business use case.

Longer-term hardening

• Hunt for the documented persistence triad as a correlated chain rather than isolated signals: a Registry Run key named 'WindowsUpdate', an schtasks.exe-created scheduled task, and a WMI event subscription polling roughly every 60 seconds -- this combination, plus LSASS access and process injection, is the exact chain Talos lists as an observable signal.
• Run Cisco Talos's open-source CAIRN toolkit (github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network) against internal binary/metadata corpora to hunt for embedded prompt templates, LLM API endpoints, and agentic tool-call syntax in unknown executables.
• Extend browser-credential-store and cryptocurrency-wallet-extension monitoring (Chrome/Edge Login Data, Firefox logins.json, MetaMask/Exodus wallet files) given this threat's demonstrated single-pass multi-target credential and wallet theft.

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: 64-bit Windows (no specific version constraint disclosed by Talos)
• Google — Chrome
  Vulnerable versions: local browser credential store (Login Data)
• Microsoft — Edge
  Vulnerable versions: local browser credential store (Login Data)
• Mozilla — Firefox
  Vulnerable versions: local browser credential store (logins.json)
• MetaMask — MetaMask wallet browser extension
  Vulnerable versions: local wallet data files
• Exodus — Exodus wallet
  Vulnerable versions: local wallet data files

Timeline of ClosedQuorum AI voting malware

• 2025-01-01 Binary artifacts later recovered from locked-ioc-14 connect its developer to postings on criminal carding forums dating back to 2025 (exact date not disclosed by Talos).
• 2025-07-01 LAMEHUG, cited by Talos as the earliest documented AI-integrated malware, is first identified by CERT-UA, establishing the precedent class locked-ioc-14 extends.
• 2026-06-17 Analysis confirms the sample is a development/test build shipping placeholder API credentials and a dummy Discord webhook, with no evidence of live operational use.
• 2026-06-17 locked-ioc-17 performs static analysis of the locked-ioc-14 sample, identifying the four-model LLM voting architecture, decision schema, and capability set from the binary.
• 2026-07-03 Build artifacts show the locked-ioc-14 binary was renamed, part of the seven-day development build chain Talos reconstructs from the six recovered SHA256 samples.
• 2026-09-22 BleepingComputer, Help Net Security, and other outlets publish coverage of the locked-ioc-14/locked-ioc-19 disclosure, with Talos stating no confirmed in-the-wild deployment has been observed.
• 2026-09-22 locked-ioc-17 publishes 'The Closed Quorum: Inside the first reported autonomous AI C2 implant' and simultaneously releases the open-source locked-ioc-19 hunting toolkit that discovered it.

Sources cited for ClosedQuorum AI voting malware

• The Closed Quorum: Inside the first reported autonomous AI C2 implant Cisco Talos · Vendor report · 2026-09-22
• Introducing CAIRN: Frontier tracking for AI-integrated malware Cisco Talos · Vendor report · 2026-09-22
• Cognitive Artifact Intelligence Research Network (CAIRN) GitHub · Code repository · 2026-09-22
• CLOSEDQUORUM: Autonomous AI Malware Explained blog.netmanageit.com · Blog · 2026-09-22
• New ClosedQuorum Windows malware uses AI for attack decisions BleepingComputer · News · 2026-09-22
• Researchers uncover malware that uses AI to choose its next move Help Net Security · News · 2026-09-22

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant Previous report
• eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoring Next report