Full Report
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.
Analysis Summary
# Tool/Technique: CLOSEDQUORUM
## Overview
CLOSEDQUORUM is a sophisticated Windows-based implant that utilizes a "LLM-as-C2" architecture. It is designed for fully autonomous operation, delegating the decision-making process of the attack chain to a panel of commercial Large Language Models (LLMs). By using consensus-based reasoning from multiple AI providers, it eliminates the need for a traditional, human-operated command and control server.
## Technical Details
- **Type:** Malware Family (Autonomous AI-Integrated Implant)
- **Platform:** Windows (64-bit)
- **Capabilities:** Autonomous C2, credential harvesting, crypto wallet theft, LSASS dumping, process injection, and anti-analysis/evasion.
- **First Seen:** Discovered/Reported June 2026 (linked to developer activity dating back to 2025).
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols] (Queries to LLM APIs)
- [T1568 - Dynamic Resolution] (Autonomous selection of actions)
- **[TA0006 - Credential Access]**
- [T1003.001 - OS Credential Dumping: LSASS Memory]
- [T1555 - Credentials from Password Stores] (Browser/Wallet extraction)
- **[TA0004 - Privilege Escalation / TA0005 - Evasion]**
- [T1055.001 - Process Injection: Dynamic-link Library Injection] (Early Bird Injection)
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Code Repository/Webhook] (Discord CDN/Webhooks)
## Functionality
### Core Capabilities
- **LLM Consensus Orchestration:** Queries up to four LLM providers (DeepSeek, Qwen, Mistral, and Google Gemini) to determine the next tactical action.
- **Multi-Model Voting (Quorum):** Tallying votes from different AI models to select an action, reducing the "hallucination" risk of a single model.
- **Data Theft:** Specifically targets browser credentials and cryptocurrency wallets.
- **Exfiltration:** Uses Discord webhooks/CDN for data staging and exfiltration.
### Advanced Features
- **Effort Displacement:** The malware collapses the "decision space" into a set of choices that AI can reason through, allowing the attack to progress while the human operator is offline.
- **Evasive C2 Infrastructure:** By communicating with legitimate commercial LLM endpoints, the malware blends in with normal HTTPS traffic, bypassing traditional IP/domain reputation blocks.
- **Early Bird Injection:** A technique used to execute malicious code within the context of a legitimate process during its initialization phase to evade hooks.
## Indicators of Compromise
- **File Hashes:**
- SHA256: `250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7`
- **File Names:** `gohno-final.exe`, `earlyburb.exe`
- **Registry Keys:** N/A (Based on provided text)
- **Network Indicators:**
- `api.deepseek[.]com`
- `openrouter[.]ai`
- `api.mistral[.]ai`
- `cdn.discordapp[.]com`
- **Behavioral Indicators:**
- High-frequency API calls to multiple commercial AI providers.
- Unexpected LSASS memory access attempts.
- Process injection behaviors during system startup.
## Associated Threat Actors
- **Developer/Group:** Linked to a developer active in criminal carding and dating forums (identified via CAIRN project artifacts; specific group name not provided).
## Detection Methods
- **Signature-based:** Detection of Go-compiled binaries containing DWARF function names like `main.ModelOrchestrator` and `main.interModelDiscussion`.
- **Behavioral:** Monitoring for unusual outgoing HTTPS traffic to multiple LLM provider endpoints from a single non-browser process.
- **YARA Rule Snippet:**
- Matches on strings: `"You are an advanced malware strategist."`, `main.lsassDump`, and `main.extractCryptoWallets`.
## Mitigation Strategies
- **API Monitoring:** Monitor and rate-limit access to commercial LLM APIs within corporate environments.
- **Endpoint Protection:** Use EDR solutions to detect and block LSASS dumping and unauthorized process injection (Early Bird).
- **Network Filtering:** Restrict access to Discord or other unauthorized webhook/CDN services used for data exfiltration.
## Related Tools/Techniques
- **CAIRN Project:** The research toolkit used to discover the malware.
- **Early Bird Injection:** A known evasion technique used by various malware families.
- **AI-Generated Phishing:** A related "speed/scale" application of AI in offensive operations.