A new Windows malware, ClosedQuorum, uses AI models to autonomously decide its actions during post-compromise attack stages, according to Cisco Talos researchers. The malware employs a voting system among AI models to determine its next steps, marking a significant shift in attack automation.
TL;DR
- ClosedQuorum malware uses AI models to autonomously execute attacks on Windows systems.
- The malware employs a voting system among Google Gemini, DeepSeek, Qwen, and Mistral AI models to decide its actions.
- Cisco Talos warns that this represents an architectural shift towards attack-chain automation, potentially increasing the speed and scale of malicious operations.
What happened
ClosedQuorum, a new Windows malware, uses AI models to autonomously determine its actions during post-compromise stages of an attack. The Go-based malware operates without human intervention, using reconnaissance information and a voting system to decide its next steps on infected hosts. When votes are tied, DeepSeek has priority in making the final call, followed by Qwen, Mistral, and Gemini.
The malware is restricted to a predefined set of decisions, including stealing credentials, injecting shellcode, persisting on the system, and moving laterally. Stolen details are passed to the operators via a Discord webhook, allowing the attack to be fully automated. Cisco Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of AI models.
Why it matters
The use of AI models in ClosedQuorum adds greater speed and scaling potential to malicious operations, eliminating the need for human interaction. This allows the attack chain to proceed at any time, increasing the potential impact of such malware.
However, Cisco Talos notes that this approach may pose challenges, such as hitting rate limits, malformed outputs, or temporary unavailability of commercial APIs that the system relies on. It is unclear whether ClosedQuorum is a test or experiment, but it represents a significant shift towards attack-chain automation.
Key facts
- ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide its actions.
- The malware employs a voting system among the AI models, with DeepSeek having priority in case of tied votes.
- ClosedQuorum is restricted to a predefined set of decisions, including stealing credentials, injecting shellcode, persisting on the system, and moving laterally.
- Stolen details are passed to the operators via a Discord webhook, allowing the attack to be fully automated.
- Cisco Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical C2 decisions to a panel of AI models.
- The malware was discovered through CAIRN, an open-source toolkit released by Cisco Talos to help researchers track and analyze AI-integrated malware.
- Artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
Context
The use of AI models in malware represents a significant evolution in cyber threats. By automating decision-making processes, attackers can increase the speed and scale of their operations, making it more challenging for defenders to keep up.
This development highlights the need for advanced security measures that can detect and mitigate AI-powered attacks. As AI technology continues to evolve, so too will the tactics and techniques used by malicious actors, necessitating ongoing innovation in cybersecurity.