The Closed Quorum Inside the First Reported Autonomous AI C2 Implant

The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant

🚀 CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). To our knowledge, it is the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets. It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI. CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement. While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.

Design and Functionality

The foundational design choice in CLOSEDQUORUM is the treatment of LLM providers as the C2 infrastructure. Instead of a singular, unique C2 server, CLOSEDQUORUM calls up to four commercial LLM provider endpoints used by thousands of legitimate applications daily. The name reflects the architecture. A quorum is a decision-making body that requires some minimum of participants to act. CLOSEDQUORUM’s quorum is up to four LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini. The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts based on their judgment. Each active model votes on the next action, and the action receiving the most votes is selected. The multi-provider design serves both aggregation and resilience, reducing the effect of individual refusals, timeouts, and malformed responses. It increases the likelihood of obtaining a valid decision but does not guarantee one. In any tie, an order of preference kicks in: DeepSeek first, then Qwen, then Mistral, then Gemini. The LLM panel is not free to respond in any format. CLOSEDQUORUM constrains it to a typed JSON schema representing a specific attack-decision language. The system prompt, as extracted from the binary, reads “You are an advanced malware strategist. Provide ONLY executable decisions.”

Technical Specifications

CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable compiled in Go. The Decision field routes to capability modules of main.main: steal simultaneously invokes lsassDump(), dumpBrowserCredentials(), and extractCryptoWallets(); all three run together. inject calls generateShellcode() then branches: process_hollow exploit type routes to injectProcess() (PEB-walk hollowing); anything else routes to earlyBirdInject() (APC injection). persist dispatches to establishPersistence(). The attackers’ interest is aligned with extracting user credentials, specifically the implant targets: LSASS credential dumping – lsassDump() extracts Windows domain/local credentials from memory, Browser credential theft – dumpBrowserCredentials() targeting Chrome, Edge, and Firefox saved passwords, Crypto wallet extraction – extractCryptoWallets() hitting MetaMask (Chrome extension), Exodus (exodus.wallet), and Ethereum wallets (ethPath). Stolen material arrives AES-256-GCM encrypted in the operator’s Discord channel as base64 code blocks. CLOSEDQUORUM appears to operate as an operator-configured service rather than malware deployed directly by its developer. The publicly observed distribution binary is an inert template: all LLM API credentials initialize to dummy_api_key and the Discord webhook initializes to dummy_webhook_url. The binary is non-functional as distributed. Evidence from development builds indicates the developer produces a customized executable for each operator. The inferred distribution model: Developer generates a custom binary with the operator’s Discord webhook and LLM API keys injected at compile time. Operator receives a configured executable and handles delivery independently. Stolen credentials arrive in the operator’s Discord channel, AES-256-GCM encrypted with a daily-rotating key the operator can derive from the message timestamp.

For more details, check out the full article: Read full article