ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel
ClosedQuorum (TL-2026-2621), also tracked as CLOSEDQUORUM, is a medium-severity malware campaign, first published 2026-09-22. It has no confirmed attribution, affects Microsoft Windows, maps to 12 MITRE ATT&CK techniques (T1003.001, T1033, T1053.005), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-2621
- Threat ID
- TL-2026-2621
- Also known as
- CLOSEDQUORUM
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-09-22
- Last reviewed
- 2026-09-22
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in ClosedQuorum
Malware and tooling: CLOSEDQUORUM, CAIRN, DeepSeek API, Google Gemini API, Mistral API, Qwen API
Cisco Talos discovered CLOSEDQUORUM, a 16.4MB Go-based Windows implant that queries Google Gemini, DeepSeek, Qwen, and Mistral and selects its next post-compromise action (steal, inject, persist, move) by plurality vote among the models, with DeepSeek breaking ties. Talos calls it the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of commercial LLMs; the analyzed build is a non-functional template with placeholder API keys, and Talos found no confirmed in-the-wild deployment, but binary artifacts tie the developer to 2025 carding-forum postings.
How ClosedQuorum works
CLOSEDQUORUM is a 64-bit Windows implant written in Go with CGO enabled (CGO_ENABLED=1) and confirmed direct Windows syscalls, discovered by Cisco Talos and disclosed alongside the release of Talos's open-source CAIRN (Cognitive Artifact Intelligence Research Network) hunting toolkit on 2026-09-22. Rather than receiving tasking from a human operator or a traditional C2 server, the implant packages host-context telemetry (hostname, OS architecture, CPU count, Windows version, admin status, injected at runtime via a 'TARGET: %s' template) into a constrained system prompt ('You are an advanced malware strategist. Provide ONLY executable decisions.') and queries four commercial LLM providers in sequence: DeepSeek, Qwen, Mistral, and Google Gemini. Each model returns a typed JSON response constrained to a fixed decision schema (Decision, Reasoning, target_process, exploit_type, evasion_method, payload_config), and the implant selects the action chosen by a plurality of the four models. When votes tie, a fixed priority order resolves it: DeepSeek first, then Qwen, then Mistral, then Gemini; if all four model queries fail, the implant falls back to a 'consensus' state that causes it to sleep and retry.
The decision space is restricted to four options. 'Steal' simultaneously runs LSASS credential dumping via MiniDumpWriteDump, browser credential extraction from Chrome, Edge, and Firefox (targeting Login Data / logins.json stores), and cryptocurrency-wallet extraction from MetaMask, Exodus, and Ethereum wallet paths. 'Inject' generates shellcode and delivers it via one of two techniques: earlyBirdInject() (APC queuing into a suspended process) or process_hollow() (PEB-walk process hollowing with entry-point overwrite). 'Persist' installs a persistence triad: a Registry Run key disguised as a 'WindowsUpdate' value, a scheduled task created via schtasks.exe, and a WMI event subscription that re-triggers roughly every 60 seconds via a performance-counter query. 'Move' is present in the decision schema as a lateral-movement option, but the analyzed build has no corresponding handler and cannot execute it.
Stolen data is encrypted with AES-256-GCM using a key derived from the current date, then Base64-encoded and exfiltrated to the operator via a Discord webhook in ~1,900-byte segments transmitted roughly once per second. Talos characterizes the date-derived key as obfuscation rather than genuine key separation, since the developer can trivially recompute it.
Talos discovered the sample via CAIRN, a new open-source, metadata-only toolkit (no binary execution or download) that hunts for 'cognitive artifacts' of AI integration in malware — embedded prompt templates, LLM provider API endpoints, AI-sandbox evasion strings, local-model runtime indicators, and agentic tool-call syntax — using a three-tier YARA ontology (primitive artifact presence, behavioral context, confirmed operational family) plus embedding-based semantic clustering (UMAP/HDBSCAN) for pivoting across related samples. CLOSEDQUORUM is catalogued under CAIRN's archetype A4 ('LLM-Tasked C2'), and Talos cites LAMEHUG (first documented by CERT-UA in July 2025) as the earliest known precedent for AI-integrated malware.
The analyzed sample was a development/test build: it shipped with placeholder API credentials and a dummy Discord webhook, was statically analyzed by Talos on 2026-06-17, and carries a later binary-renaming artifact dated 2026-07-03. Talos found no confirmed in-the-wild deployment or evidence the autonomous loop has executed against a live target — the finding is static-analysis-only. However, artifacts recovered from the binary connected its developer to postings on criminal carding forums dating back to 2025, and Talos assesses the primary motivation as financial (credential and cryptocurrency theft). Talos researcher Ryan Fetterman described CLOSEDQUORUM as, to Talos's knowledge, 'the first publicly documented Windows implant to apply this model to tactical command and control,' and framed the disclosure as giving defenders 'an open window to study this transition' toward AI-delegated attack-chain automation before it reaches operational maturity.
MITRE ATT&CK techniques used in TL-2026-2621
Credential Access
T1003.001 LSASS Memory; T1555.003 Credentials from Web Browsers
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Persistence
T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription; T1547.001 Registry Run Keys / Startup Folder
Defense Evasion
T1055.004 Asynchronous Procedure Call; T1055.012 Process Hollowing
Command and Control
T1102.002 Bidirectional Communication; T1573.001 Symmetric Cryptography
Exfiltration
Affected products and versions in ClosedQuorum
- Microsoft — Windows
Vulnerable versions: 64-bit Windows (no specific version constraint disclosed by Talos) - Google — Chrome
Vulnerable versions: local browser credential store (Login Data) - Microsoft — Edge
Vulnerable versions: local browser credential store (Login Data) - Mozilla — Firefox
Vulnerable versions: local browser credential store (logins.json) - MetaMask — MetaMask wallet browser extension
Vulnerable versions: local wallet data files - Exodus — Exodus wallet
Vulnerable versions: local wallet data files
Remediation for ClosedQuorum
Immediate actions
- Monitor egress to LLM-provider API domains (api.deepseek.com, api.mistral.ai, openrouter.ai, and Google Gemini's generativelanguage.googleapis.com) from unexpected or non-browser processes -- Talos's CAIRN flags 'AI-provider API traffic from unexpected executables' and 'correlated requests to multiple model endpoints within short intervals' as a core detection signal for this malware class.
- Alert on Discord webhook/CDN traffic (discord.com/api/webhooks, cdn.discordapp.com) originating from non-Discord-client processes, especially repeated small POST bursts (~1,900 bytes at ~1-second intervals) consistent with CLOSEDQUORUM's segmented exfiltration.
- Enforce LSASS access hardening (Credential Guard / PPL for lsass.exe) to block MiniDumpWriteDump-based credential dumping used by the 'steal' action.
Workarounds
- Restrict outbound access from standard endpoints to consumer/commercial AI-provider APIs via egress allow-listing where no legitimate business use exists, rather than relying on blocklists against a class of legitimate infrastructure.
- Block or alert on Discord webhook domains at the network perimeter for host groups with no legitimate Discord business use case.
Longer-term hardening
- Hunt for the documented persistence triad as a correlated chain rather than isolated signals: a Registry Run key named 'WindowsUpdate', an schtasks.exe-created scheduled task, and a WMI event subscription polling roughly every 60 seconds -- this combination, plus LSASS access and process injection, is the exact chain Talos lists as an observable signal.
- Run Cisco Talos's open-source CAIRN toolkit (github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network) against internal binary/metadata corpora to hunt for embedded prompt templates, LLM API endpoints, and agentic tool-call syntax in unknown executables.
- Extend browser-credential-store and cryptocurrency-wallet-extension monitoring (Chrome/Edge Login Data, Firefox logins.json, MetaMask/Exodus wallet files) given this threat's demonstrated single-pass multi-target credential and wallet theft.
Timeline of ClosedQuorum
- Binary artifacts later recovered from CLOSEDQUORUM connect its developer to postings on criminal carding forums dating back to 2025 (exact date not disclosed by Talos).
- LAMEHUG, cited by Talos as the earliest documented AI-integrated malware, is first identified by CERT-UA, establishing the precedent class CLOSEDQUORUM extends.
- Analysis confirms the sample is a development/test build shipping placeholder API credentials and a dummy Discord webhook, with no evidence of live operational use.
- Cisco Talos performs static analysis of the CLOSEDQUORUM sample, identifying the four-model LLM voting architecture, decision schema, and capability set from the binary.
- Build artifacts show the CLOSEDQUORUM binary was renamed, part of the seven-day development build chain Talos reconstructs from the six recovered SHA256 samples.
- BleepingComputer, Help Net Security, and other outlets publish coverage of the CLOSEDQUORUM/CAIRN disclosure, with Talos stating no confirmed in-the-wild deployment has been observed.
- Cisco Talos publishes 'The Closed Quorum: Inside the first reported autonomous AI C2 implant' and simultaneously releases the open-source CAIRN hunting toolkit that discovered it.
Sources cited for ClosedQuorum
- New ClosedQuorum Windows malware uses AI for attack decisions
- The Closed Quorum: Inside the first reported autonomous AI C2 implant
- Introducing CAIRN: Frontier tracking for AI-integrated malware
- Cognitive Artifact Intelligence Research Network (CAIRN)
- Researchers uncover malware that uses AI to choose its next move
- CLOSEDQUORUM: Autonomous AI Malware Explained
More in malware
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Detection coverage for TL-2026-2621
As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2621 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.