The Closed Quorum: Inside the first reported autonomous AI C2 implant

Cisco Talos has identified CLOSEDQUORUM, a novel Windows implant that leverages AI to automate command and control operations. This malware, which is currently a template and requires operator configuration, delegates attack decisions to a panel of four Large Language Models (LLMs) – DeepSeek, Qwen, Mistral, and Gemini – to perform tasks like credential theft and process injection. CLOSEDQUORUM represents a significant shift in offensive cyber operations, moving away from operator-driven control and towards autonomous AI-powered attacks. The malware operates as a credentials-as-a-service model, with stolen data delivered to the operator via Discord.

CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets. It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.

The name reflects the architecture. A quorum is a decision-making body that requires some minimum of participants to act. CLOSEDQUORUM's quorum is up to four LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini. The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment.

The CLOSEDQUORUM C2 architecture supports up to four LLM provider integrations. Each active model votes on the next action, and the action receiving the most votes is selected.

Our static analysis confirms the full details of the autonomous decision loop, and development builds demonstrate build-time injection of provider credentials. The publicly distributed binary is an inert template: all LLM API credentials initialize to dummy_api_key and the Discord webhook initializes to dummy_webhook_url. The binary is non-functional as distributed.

Evidence from development builds indicates the developer produces a customized executable for each operator. The inferred distribution model:

• Developer generates a custom binary with the operator's Discord webhook and LLM API keys injected at compile time.
• Operator receives a configured executable and handles delivery independently
• Stolen credentials arrive in the operator's Discord channel, AES-256-GCM encrypted with a daily-rotating key the operator can derive from the message timestamp.

The encryption uses a symmetric key derived from the current date, not a hardcoded asymmetric key. The developer's infrastructure could theoretically decrypt an operator's exfil if they know the date, which they always do. This is obfuscation, not true confidentiality separation between developer and operator. Each operator nonetheless has a distinct exfil channel and a distinct binary build.

If operated as assessed, this is a credentials-as-a-service model where the service differentiator is the autonomous LLM orchestration layer. An operator who acquires CLOSEDQUORUM does not need to be online to run their campaign. They deploy the binary, and the LLM panel runs the attack.

Defensive implications: CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors. No single indicator fully identifies the architecture, but the combination is distinct:

• AI-provider API traffic originating from an unexpected Windows executable
• Similar requests potentially sent to several model providers within a short interval
• Structured prompts containing host context or offensive capability language (Note: This would likely only visible through TLS inspection or provider-side telemetry)
• Numerous known malware techniques for process injection, LSASS access, or persistence creation
• Discord webhook communication from the same process or host
• Repeated execution at randomized 5 – 15-minute intervals

The most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking. Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently. Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence.