Cisco Talos researchers have published analysis of ClosedQuorum, a Go-based Windows implant that removes the human operator from post-compromise decisions entirely. Instead of receiving commands from a C2 server, ClosedQuorum sends reconnaissance data it has gathered from an infected machine to four AI models — Google Gemini, DeepSeek, Qwen, and Mistral — and asks them to vote on what to do next. When votes are tied, DeepSeek casts the deciding ballot, followed by Qwen, Mistral, and Gemini as tiebreakers.
The malware’s action menu is limited but dangerous: it can simultaneously dump LSASS credentials, steal saved passwords from Chrome, Edge, and Firefox, and extract wallets from MetaMask, Exodus, and Ethereum. It can also generate shellcode and inject it via process hollowing or Early Bird APC injection, and it can execute a persistence module. A lateral-movement option is defined in the code but has no handler in the analyzed build — it cannot execute. All stolen data is sent to the attacker through a Discord webhook, meaning once the malware is delivered, no human interaction is required for the entire attack chain to complete. Cisco Talos describes ClosedQuorum as “the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of AI models,” and warns it represents an “architectural shift towards attack-chain automation.” The analyzed binary contains placeholder API keys and a dummy webhook, so it is likely a distributable framework that operators customize before deployment. No confirmed in-the-wild attacks have been observed yet, though developer artifacts link to criminal forum activity dating to 2025.