SECURITY Signal 428
CLOSEDQUORUM malware reportedly uses LLM quorum to autonomously select post-compromise actions
↗
Cisco Talos identified a Go-based Windows implant that queries four LLM providers to vote on which predefined malicious actions to execute without human intervention.
This malware removes the human bottleneck from the post-compromise phase, allowing attacks to continue indefinitely and at a scale that exceeds operator attention spans. Defenders can no longer rely on blocking specific C2 domains, as the malware uses legitimate AI provider endpoints, forcing a shift toward behavioral detection of combined malicious activities.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The malware queries Gemini, DeepSeek, Qwen, and Mistral in sequence, with DeepSeek holding tie-breaking precedence in the voting mechanism.
LLM decisions are constrained to predefined modules for credential theft, code injection, and persistence, rather than generating novel attack code.
Cisco Talos released the CAIRN toolkit as an open-source repository to help hunt and classify this emerging class of AI-integrated malware.
THE READ
What the cluster adds up to.
CLOSEDQUORUM represents a shift in malware architecture where the decision-making phase of an intrusion is delegated to large language models. Instead of waiting for human commands, the binary queries four distinct LLM providers to determine its next step. This design eliminates the dependency on operator availability, allowing the malware to act continuously regardless of the attacker's working hours or cognitive load.
The system operates on a quorum mechanism where the models vote on predefined actions, such as stealing credentials or injecting shellcode. If the vote is tied, a specific hierarchy determines the outcome, with DeepSeek’s vote taking precedence over Qwen, Mistral, and Gemini. The models are constrained by a system prompt that limits them to selecting only executable decisions from a fixed set of capability modules, preventing them from generating arbitrary or unpredictable code.
For defenders, this approach complicates traditional detection methods that rely on blocking known malicious domains. Since the malware communicates with legitimate AI providers like Gemini and Mistral, domain-based blocking is ineffective and risks disrupting legitimate business applications. Talos analysts recommend focusing on behavioral characteristics, specifically looking for the combination of AI provider contacts with malicious actions like LSASS memory dumping or process injection.
The malware is built in Go and is customized for each operator by injecting Discord webhooks and LLM API keys at compile time. Stolen data is encrypted with AES-256-GCM using a daily rotating key derived from message timestamps before being sent to the operator's Discord channel. Although no in-the-wild deployment has been observed, artifacts link the developer to criminal forum activity dating back to 2025.
Cisco Talos discovered the binary using its new CAIRN toolkit, which is designed to hunt and track AI-integrated malware. The toolkit has been made available as an open-source repository to assist the broader security community in identifying similar threats. This development highlights the growing need for specialized tools to analyze malware that integrates cognitive AI systems into its command-and-control logic.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER