CLOSEDQUORUM is the first publicly documented Windows implant that uses a closed quorum of up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Google Gemini) as its C2 infrastructure. Instead of traditional C2 servers, it queries these LLMs sequentially, each providing a decision from a constrained JSON schema representing specific attack actions. The malware aggregates these decisions by plurality vote and executes the winning action autonomously, without human operator commands. Actions include stealing credentials, dumping browser data, extracting crypto wallets, injecting shellcode, and establishing persistence. The malware is compiled in Go with embedded C code for direct Windows system calls. The design reduces attacker infrastructure footprint and increases resilience by leveraging widely used LLM endpoints. The public distribution build uses dummy API keys, limiting observed execution. This malware exemplifies AI-driven effort displacement in offensive cyber operations, where AI systems replace human operators in attack phases.

If deployed, CLOSEDQUORUM could autonomously execute phases of an attack chain, including credential theft and crypto wallet extraction, without requiring ongoing attacker control. This reduces the need for attacker infrastructure and human involvement, potentially increasing attack persistence and scale. The malware's use of commercial LLM endpoints for C2 complicates detection and blocking, as these services are widely used and legitimate. However, there is no confirmed active exploitation in the wild at this time.

No official patch or remediation is available as this is a novel malware implant rather than a software vulnerability. Detection efforts should focus on identifying unusual use of LLM API endpoints from endpoints and monitoring for behaviors consistent with credential and crypto wallet theft. Traditional C2 blocking techniques may be less effective due to the use of commercial LLM services. Security teams should stay informed on research developments from Cisco Talos’ CAIRN project and apply threat intelligence updates accordingly.