# ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel

> Cisco Talos discovered CLOSEDQUORUM, a 16.4MB Go-based Windows implant that queries Google Gemini, DeepSeek, Qwen, and Mistral and selects its next post-compromise action (steal, inject, persist, move) by plurality vote among the models, with DeepSeek breaking ties. Talos calls it the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of commercial LLMs; the analyzed build is a non-functional template with placeholder API keys, and Talos found no confirmed in-the-wild deployment, but binary artifacts tie the developer to 2025 carding-forum postings.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2621
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-closedquorum-ai-voting-malware-tl-2026-2621.webp?v=4efc7928 (Threadlinqs threat intel: ClosedQuorum AI-Voting Windows Malware: Detection & IOCs (TL-2026-2621) — Medium severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2621
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

CLOSEDQUORUM is a 64-bit Windows implant written in Go with CGO enabled (CGO_ENABLED=1) and confirmed direct Windows syscalls, discovered by Cisco Talos and disclosed alongside the release of Talos's open-source CAIRN (Cognitive Artifact Intelligence Research Network) hunting toolkit on 2026-09-22. Rather than receiving tasking from a human operator or a traditional C2 server, the implant packages host-context telemetry (hostname, OS architecture, CPU count, Windows version, admin status, injected at runtime via a 'TARGET: %s' template) into a constrained system prompt ('You are an advanced malware strategist. Provide ONLY executable decisions.') and queries four commercial LLM providers in sequence: DeepSeek, Qwen, Mistral, and Google Gemini. Each model returns a typed JSON response constrained to a fixed decision schema (Decision, Reasoning, target_process, exploit_type, evasion_method, payload_config), and the implant selects the action chosen by a plurality of the four models. When votes tie, a fixed priority order resolves it: DeepSeek first, then Qwen, then Mistral, then Gemini; if all four model queries fail, the implant falls back to a 'consensus' state that causes it to sleep and retry.

The decision space is restricted to four options. 'Steal' simultaneously runs LSASS credential dumping via MiniDumpWriteDump, browser credential extraction from Chrome, Edge, and Firefox (targeting Login Data / logins.json stores), and cryptocurrency-wallet extraction from MetaMask, Exodus, and Ethereum wallet paths. 'Inject' generates shellcode and delivers it via one of two techniques: earlyBirdInject() (APC queuing into a suspended process) or process_hollow() (PEB-walk process hollowing with entry-point overwrite). 'Persist' installs a persistence triad: a Registry Run key disguised as a 'WindowsUpdate' value, a scheduled task created via schtasks.exe, and a WMI event subscription that re-triggers roughly every 60 seconds via a performance-counter query. 'Move' is present in the decision schema as a lateral-movement option, but the analyzed build has no corresponding handler and cannot execute it.

Stolen data is encrypted with AES-256-GCM using a key derived from the current date, then Base64-encoded and exfiltrated to the operator via a Discord webhook in ~1,900-byte segments transmitted roughly once per second. Talos characterizes the date-derived key as obfuscation rather than genuine key separation, since the developer can trivially recompute it.

Talos discovered the sample via CAIRN, a new open-source, metadata-only toolkit (no binary execution or download) that hunts for 'cognitive artifacts' of AI integration in malware — embedded prompt templates, LLM provider API endpoints, AI-sandbox evasion strings, local-model runtime indicators, and agentic tool-call syntax — using a three-tier YARA ontology (primitive artifact presence, behavioral context, confirmed operational family) plus embedding-based semantic clustering (UMAP/HDBSCAN) for pivoting across related samples. CLOSEDQUORUM is catalogued under CAIRN's archetype A4 ('LLM-Tasked C2'), and Talos cites LAMEHUG (first documented by CERT-UA in July 2025) as the earliest known precedent for AI-integrated malware.

The analyzed sample was a development/test build: it shipped with placeholder API credentials and a dummy Discord webhook, was statically analyzed by Talos on 2026-06-17, and carries a later binary-renaming artifact dated 2026-07-03. Talos found no confirmed in-the-wild deployment or evidence the autonomous loop has executed against a live target — the finding is static-analysis-only. However, artifacts recovered from the binary connected its developer to postings on criminal carding forums dating back to 2025, and Talos assesses the primary motivation as financial (credential and cryptocurrency theft). Talos researcher Ryan Fetterman described CLOSEDQUORUM as, to Talos's knowledge, 'the first publicly documented Windows implant to apply this model to tactical command and control,' and framed the disclosure as giving defenders 'an open window to study this transition' toward AI-delegated attack-chain automation before it reaches operational maturity.

## MITRE ATT&CK

- T1003.001 LSASS Memory
- T1555.003 Credentials from Web Browsers
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1546.003 Windows Management Instrumentation Event Subscription
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1055.004 Asynchronous Procedure Call
- T1055.012 Process Hollowing
- T1102.002 Bidirectional Communication
- T1573.001 Symmetric Cryptography
- T1567.004 Exfiltration Over Webhook

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Correlated LSASS Credential Dumping and Scheduled-Task Persistence (SPL)** (`TL-2026-2621-SPL-002`)

Detects the correlated combination of LSASS credential-memory access consistent with MiniDumpWriteDump and an schtasks.exe-created scheduled task on the same host within a short window. This matches CLOSEDQUORUM's LLM-selected 'steal' action (LSASS dump + browser/wallet credential theft via MiniDumpWriteDump) occurring alongside its 'persist' action (Registry Run key 'WindowsUpdate', schtasks.exe task, WMI event subscription polling ~60s).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1555.003, T1547.001, T1053.005, T1546.003, T1055.004, T1055.012
- **Data sources:** sysmon, windows_security, windows_registry, wmi_trace_log
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=windows (sourcetype="WinEventLog:Sysmon" EventCode IN (1,10)) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval technique=case(
    (match(Image,"(?i)rundll32\.exe") AND match(CommandLine,"(?i)comsvcs\.dll") AND match(CommandLine,"(?i)MiniDump")) OR (EventCode=10 AND match(TargetImage,"(?i)lsass\.exe") AND match(GrantedAccess,"0x1[0-9a-fA-F]{3}")), "T1003.001_lsass_dump",
    match(Image,"(?i)schtasks\.exe") AND match(CommandLine,"(?i)/create"), "T1053.005_scheduled_task",
    1=1, "other")
| where technique!="other"
| stats values(technique) as techniques_observed, dc(technique) as technique_count, earliest(_time) as first_seen, latest(_time) as last_seen by host, Computer, user
| where technique_count >= 2
| sort - technique_count
```

### Microsoft KQL

```kql
let LsassAccess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "rundll32.exe" and ProcessCommandLine has "comsvcs.dll" and ProcessCommandLine has "MiniDump")
| project Timestamp, DeviceName, Technique = "T1003.001", InitiatingProcessFileName, AccountName;
let SchTask = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| project Timestamp, DeviceName, Technique = "T1053.005", InitiatingProcessFileName, AccountName;
union LsassAccess, SchTask
| summarize Techniques = make_set(Technique), TechniqueCount = dcount(Technique), Accounts = make_set(AccountName) by DeviceName, bin(Timestamp, 1h)
| where TechniqueCount >= 2
```

### Sigma

```yaml
title: Correlated LSASS Credential Dumping and Scheduled-Task Persistence
id: b2c3d4e5-2222-4b3c-9d4e-5f6071829304
status: experimental
description: Detects, on the same host within a short window, both an LSASS memory-dump technique (comsvcs.dll MiniDump export via rundll32.exe) and an schtasks.exe-created scheduled task. This matches the correlated credential-theft plus persistence chain documented for CLOSEDQUORUM's LLM-selected 'steal' and 'persist' actions; pair with registry (Run key named 'WindowsUpdate') and WMI event-subscription monitoring for full triad coverage.
references:
    - https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1555.003
    - attack.persistence
    - attack.t1547.001
    - attack.t1053.005
    - attack.t1546.003
    - attack.defense-evasion
    - attack.t1055.004
    - attack.t1055.012
detection:
    selection_lsass_dump:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains|all:
            - 'comsvcs.dll'
            - 'MiniDump'
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    condition: 1 of selection_*
logsource:
    category: process_creation
    product: windows
falsepositives:
    - Authorized incident-response/forensic LSASS memory acquisition tooling (procdump, Sysinternals) run by IT security staff
    - Legitimate software-deployment or IT-automation scripts creating scheduled tasks
level: high
```

**Known false positives:**

- Authorized IR/forensic memory acquisition tooling (procdump, comsvcs.dll MiniDump usage by security staff)
- Legitimate IT/software-deployment scheduled task creation via schtasks.exe

**Tuning notes:** Correlate this alert with a companion registry-monitoring rule for HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate and a WMI __EventFilter/__EventConsumer creation rule (~60s polling) to reconstruct the full persistence triad; exclude known EDR/backup agents that legitimately touch lsass.exe via documented allowlisted paths.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (KQL) (locked: unlock with TL Creds)
- Correlated LSASS Credential Dumping and Scheduled-Task Persistence (KQL) (locked: unlock with TL Creds)
- Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (KQL) (locked: unlock with TL Creds)
- Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (Sigma) (locked: unlock with TL Creds)
- Correlated LSASS Credential Dumping and Scheduled-Task Persistence (Sigma) (locked: unlock with TL Creds)
- Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (Sigma) (locked: unlock with TL Creds)
- Non-Browser Process Correlated Connections to Multiple LLM Provider APIs (SPL) (locked: unlock with TL Creds)
- Segmented Small-Payload Exfiltration to Discord Webhook Infrastructure (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `api[.]deepseek[.]com`
- File hash: `250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7`
- Domain: `api[.]mistral[.]ai`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New ClosedQuorum Windows malware uses AI for attack decisions](https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/)
- [The Closed Quorum: Inside the first reported autonomous AI C2 implant](https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/)
- [Introducing CAIRN: Frontier tracking for AI-integrated malware](https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/)
- [Cognitive Artifact Intelligence Research Network (CAIRN)](https://github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network)
- [Researchers uncover malware that uses AI to choose its next move](https://www.helpnetsecurity.com/2026/09/22/cairn-open-source-framework-ai-malware-closedquorum/)
- [CLOSEDQUORUM: Autonomous AI Malware Explained](https://blog.netmanageit.com/closedquorum-autonomous-ai-malware-analysis/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2621