Full Report
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.
Analysis Summary
# Tool/Technique: CLOSEDQUORUM
## Overview
CLOSEDQUORUM is an experimental Windows malware identified by Cisco Talos in September 2026. It is notable for being the first publicly documented Windows implant to utilize an autonomous "AI voting" mechanism for Command and Control (C2) decision-making. Instead of receiving direct instructions from an attacker-controlled server, the malware queries multiple commercial Large Language Models (LLMs) to determine its next course of action based on the victim's environment.
## Technical Details
- **Type:** Malware (AI-integrated Windows Implant)
- **Platform:** Windows
- **Capabilities:** Credential theft, process injection, persistence, and crypto-wallet hijacking.
- **First Seen:** Code analysis dated June 17, 2026 (publicly reported September 22, 2026).
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0004 - Privilege Escalation]**
- [T1055.001 - Process Injection: Dynamic-link Library Injection]
- [T1055.012 - Process Injection: Process Hollowing]
- **[TA0006 - Credential Access]**
- [T1003.001 - OS Credential Dumping: LSASS Memory]
- [T1555.003 - Credentials from Web Browsers]
- **[TA0011 - Command and Control]**
- [T1102 - Web Service] (LLM APIs and Discord Webhooks)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Autonomous C2 Voting:** Queries four AI models—DeepSeek, Qwen, Mistral, and Google Gemini—to decide which action to take. It provides the models with system metadata and a fixed list of options.
- **Credential Stealing:** Specifically targets LSASS memory dumps, saved browser passwords (Chrome, Edge, Firefox), and cryptocurrency wallet data (MetaMask, Exodus, Ethereum).
- **Process Injection:** Utilizes "Early Bird" APC injection or process hollowing to execute malicious code within legitimate processes.
- **Discord Exfiltration:** Stolen data is encrypted, split into 1,900-byte fragments, and transmitted to an attacker's Discord channel via webhooks at a rate of one fragment per second.
### Advanced Features
- **Redundant Persistence:** Employs three simultaneous methods for persistence: Registry Run keys, Scheduled Tasks, and WMI event subscriptions (running every 60 seconds).
- **Masquerading:** Persistence mechanisms use names themed after "Windows Update" to blend in with legitimate OS activity.
- **Consensus Requirement:** The malware requires a majority "vote" from the AI models. If the models return malformed responses or fail to reach a consensus, the malware waits and retries rather than defaulting to a pre-set action.
## Indicators of Compromise
- **File Names:** Publicly known as `CLOSEDQUORUM`.
- **Registry Keys:** Values under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Windows Update themes).
- **Network Indicators:**
- `discord[.]com` (via webhooks)
- `api[.]deepseek[.]com`
- `api[.]mistral[.]ai`
- `generativelanguage[.]googleapis[.]com`
- `openrouter[.]ai`
- **Behavioral Indicators:**
- Successive API calls to multiple distinct AI providers.
- Unexpected LSASS memory access.
- Creation of WMI event subscriptions triggering every 60 seconds.
- Encrypted temporary files created in `C:\Windows\Temp\`.
## Associated Threat Actors
- Unknown; however, code artifacts link the developer to "carding" (stolen credit card trade) criminal forum posts dating back to 2025.
## Detection Methods
- **Behavioral Detection:** Monitor for "Low and Slow" data exfiltration to Discord (1,900 bytes/sec) combined with unauthorized LSASS access.
- **Network Monitoring:** Alert on endpoints contacting multiple AI service providers in a short timeframe, especially if accompanied by suspicious local execution.
- **Heuristic Scanning:** Identify WMI event subscriptions or registry keys masquerading as Windows Update services that lack valid Microsoft digital signatures.
## Mitigation Strategies
- **API Access Control:** Restrict or monitor access to commercial AI API endpoints (DeepSeek, Mistral, OpenRouter) within corporate environments.
- **Credential Protection:** Enable Windows Defender Credential Guard to protect the LSASS process from unauthorized memory dumping.
- **Process Auditing:** Implement strict process auditing to detect process hollowing and Early Bird APC injection attempts.
- **Webhook Monitoring:** Block or strictly audit the use of outbound Discord webhooks.
## Related Tools/Techniques
- **LAMEHUG:** An AI-integrated malware reported in 2025 that uses AI to write commands for pre-defined tasks (in contrast to CLOSEDQUORUM, which lets AI choose the tasks).
- **CAIRN:** An open-source tool released by Cisco Talos specifically designed to hunt for AI-integrated malware.