Full Report
'first' publicly documented Windows implant to use LLMs for C2
Analysis Summary
# Tool/Technique: CLOSEDQUORUM
## Overview
CLOSEDQUORUM is a Go-based Windows implant and is recognized as the first publicly documented malware to utilize Large Language Models (LLMs) for autonomous Command and Control (C2). Instead of relying on a human operator for instructions, the malware queries a "quorum" of AI models to decide which predefined malicious actions to execute based on the infected system's context.
## Technical Details
- **Type:** Malware (Autonomous AI-Integrated Implant)
- **Platform:** Windows
- **Capabilities:** Autonomous decision-making, credential theft, crypto-wallet hijacking, process injection, and persistence.
- **First Seen:** Publicly documented September 2026 (linked to forum activity dating back to 2025).
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- **TA0003 - Persistence**
- T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription
- **TA0004 - Privilege Escalation / TA0005 - Evasion**
- T1055.001 - Process Injection: Dynamic-link Library Injection
- T1055.012 - Process Injection: Process Hollowing
- **TA0006 - Credential Access**
- T1003.001 - OS Credential Dumping: LSASS Memory
- T1555.003 - Credentials from Web Browsers
- **TA0011 - Command and Control**
- T1102 - Web Service (LLM API & Discord)
- T1573.002 - Encrypted Channel: Asymmetric Cryptography (AES-256-GCM)
## Functionality
### Core Capabilities
- **Autonomous C2:** Queries four LLM providers (Google Gemini, DeepSeek, Qwen, and Mistral) to vote on the next course of action.
- **LLM Quorum Logic:** Tallies verdicts from the four models. Ties are broken by a priority hierarchy: DeepSeek > Qwen > Mistral > Gemini.
- **Stealth Exfiltration:** Stolen data is sent via Discord webhooks, encrypted using AES-256-GCM with keys that rotate daily based on message timestamps.
### Advanced Features
- **Effort Displacement:** Removes the "human bottleneck," allowing the malware to operate 24/7 without manual intervention.
- **System Prompting:** Hardcoded instructions define the malware as an "advanced malware strategist" and restrict LLM output to specific executable modules.
- **Customized Compilation:** Executables are likely tailored per operator, with unique API keys and Discord webhooks injected at compile time.
## Indicators of Compromise
- **File Hashes:** *(Specific hashes not provided in the article; identified via Cisco Talos CAIRN toolkit)*
- **File Names:** Typically unique per deployment due to custom compilation.
- **Registry Keys:** Associated with WMI persistence methods.
- **Network Indicators:**
- api[.]deepseek[.]com
- openrouter[.]ai
- chat[.]mistral[.]ai
- gemini[.]google[.]com
- discord[.]com/api/webhooks/
- **Behavioral Indicators:**
- Sequential DNS queries to multiple distinct AI providers.
- LSASS memory dumping followed immediately by Discord API traffic.
- Process hollowing or "Early Bird" injection techniques.
## Associated Threat Actors
- Unknown (Linked to carding forum participants active since 2025).
## Detection Methods
- **Signature-based detection:** Detection of the Go-based binary structure and specific hardcoded system prompts used for LLM interaction.
- **Behavioral detection:** Monitoring for a single process that contacts multiple LLM APIs while simultaneously performing sensitive actions (LSASS access, WMI persistence, or process injection).
- **Tooling:** Use of Cisco Talos’ **CAIRN** (Cognitive Artifact Intelligence Research Network) toolkit for identifying AI-integrated logic within binaries.
## Mitigation Strategies
- **API Monitoring:** Monitor and rate-limit organizational access to LLM APIs (DeepSeek, OpenAI, Mistral, etc.) from non-developer workstations.
- **Endpoint Protection:** Enable EDR features that block LSASS memory dumping and unauthorized process hollowing.
- **Network Filtering:** Restrict access to Discord Webhooks in enterprise environments unless specifically required for business operations.
- **Credential Protection:** Implement Credential Guard in Windows to prevent LSASS exploitation.
## Related Tools/Techniques
- **CAIRN:** The open-source hunting framework used to discover CLOSEDQUORUM.
- **Process Hollowing/Early Bird Injection:** Standard evasion techniques used by this implant.
- **LLM Orchestration:** Similar to "Agentic AI" workflows, but repurposed for malicious decision-making.