CLOSEDQUORUM (renamed from BALZAK on 2026-07-03) is a Windows implant written in Go with embedded C components for direct Windows system calls (CGO_ENABLED=1), 16.4MB, 64-bit. It replaces a conventional operator-controlled C2 channel with commercial LLM provider APIs. On each cycle it builds a TARGET context string (hostname, OS architecture, CPU count, Windows version, administrator status and the current process list) and sends the same prompt to up to four providers: DeepSeek, Qwen (reached via OpenRouter per secondary reporting), Mistral and Google Gemini. The embedded system prompt is "You are an advanced malware strategist. Provide ONLY executable decisions." Each model must answer with a JSON struct containing Decision (one of steal, inject, persist, move), Reasoning, target_process, exploit_type, evasion_method and payload_config. Providers are polled sequentially and aggregated in an interModelDiscussion() routine that tallies the Decision fields by plurality; ties are broken by a fixed provider priority (DeepSeek, then Qwen, then Mistral, then Gemini). If no consensus is reached (a "consensus" fallback string) the implant performs a no-op, sleeps and retries. Malformed, refused or rate-limited responses are discarded with no fallback execution.

Decision handlers: 'steal' runs lsassDump() (MiniDumpWriteDump with SeDebugPrivilege), dumpBrowserCredentials() (Chrome and Edge Login Data, Firefox logins.json) and extractCryptoWallets() (MetaMask extension storage, Exodus, Ethereum wallet paths), staging artifacts under C:\Windows\Temp\. 'inject' calls generateShellcode() and injects via Early Bird APC (default: create suspended process, write shellcode, NtQueueApcThread, resume) or process hollowing (PEB-walk, when the LLM returns process_hollow). 'persist' calls establishPersistence(), deploying an HKCU Run key value named WindowsUpdate, a scheduled task created with schtasks.exe, and a permanent WMI event subscription that fires every 60 seconds off a system performance query and executes a PowerShell script written to C:\Windows\Temp\wmi.ps1. 'move' has no handler in the distributed build.

Evasion: EtwEventWrite is overwritten with a RET to suppress ETW telemetry, a secondary payload is encrypted and keyed from system time (environmental keying), the implant waits 5 minutes before first activity and then polls at randomized 5-15 minute intervals, and persistence artifacts use Windows Update themed names.

Exfiltration: stolen data is encrypted with AES-256-GCM using a key derived from the current date (not hardcoded), base64-encoded, split into 1,900-byte chunks and posted to a compile-time configured Discord webhook at 1-second intervals. Each message also reports the winning decision, the LLM reasoning, target_process, exploit_type, evasion_method, payload_config, model name and timestamp to the operator. The developer builds customized binaries with the operator's credentials injected at compile time.

Status and attribution: the publicly distributed binary contains dummy_api_key and dummy_webhook_url placeholders and is an inert template that does not work out of the box; Talos also saw a build chain spanning about 7 days of iterative development. Talos performed static analysis only. Artifacts link the developer to criminal-forum postings related to carding dating to 2025. Malpedia's page lists UAT-11795, UAT-7810 and UAT-8302 only as related-reading entries from the same library, not as attributed actors, so no actor is assigned. The sample was classified with Talos's open-source CAIRN (Cognitive Artifact Intelligence Research Network) toolkit (RAT / LLM-tasked C2, tier T3, high confidence, archetype A4), released alongside the report. Talos frames CLOSEDQUORUM as evidence that attack-chain automation is arriving, with expanding portions of the chain executable without operator involvement. Defensive weaknesses in the design include provider refusals, rate limits, malformed output handling and the predictable tie-break order. Detection guidance favors correlating multi-provider LLM API calls from non-standard executables with LSASS access, process injection, WMI persistence and Discord webhook traffic, rather than blocking AI provider domains wholesale.