ClosedQuorum: First Autonomous AI Implant Uses LLMs for Command and Control
Cisco Talos has identified CLOSEDQUORUM, a novel Windows implant that utilizes AI for autonomous command and control (C2), delegating decisions to a quorum of LLMs.
Cisco Talos researchers have uncovered CLOSEDQUORUM, a groundbreaking Windows implant that represents a significant leap in autonomous cyberattack capabilities. Unlike previous AI-driven malware that augmented human operators, CLOSEDQUORUM delegates the critical command and control (C2) functions entirely to a panel of large language models (LLMs). This means the malware can independently decide on and execute actions, such as harvesting credentials and cryptocurrency wallets, without direct human intervention.
While the researchers have not confirmed active deployment in the wild, artifacts linking the malware's developer to criminal forums dating back to 2025 suggest potential real-world use. This discovery highlights a new dimension of AI's impact on offensive cyber operations: effort displacement. Beyond merely increasing the speed and scale of attacks, AI is now capable of taking over entire phases of an attack chain, reducing the reliance on human operators and their inherent limitations like attention spans and working hours.
The CLOSEDQUORUM implant is a 64-bit Windows executable compiled in Go. Its unique architecture treats commercial LLM providers as its C2 infrastructure. Instead of relying on traditional, attributable, and blockable C2 servers, it queries up to four LLM endpoints—DeepSeek, Qwen, Mistral, and Google Gemini. This approach makes it significantly harder for defenders to track and block, as these endpoints are used by countless legitimate applications daily.
The decision-making process within CLOSEDQUORUM involves a "quorum" of LLMs. The implant queries multiple models sequentially, aggregates their responses, and uses a plurality voting system to determine the next action. This multi-provider design enhances resilience, mitigating the impact of individual model refusals, timeouts, or malformed responses, thereby increasing the likelihood of obtaining a valid decision.
If all LLM providers fail to return a usable decision, the malware defaults to a consensus mechanism that causes it to sleep and retry rather than taking a potentially harmful default action. This sophisticated fallback mechanism ensures continued operation even under adverse conditions. The implant's functionality includes harvesting user credentials and crypto wallets, demonstrating its potential for significant financial and data theft.
The development of CLOSEDQUORUM signifies a paradigm shift in how attackers can operate. By offloading decision-making to AI, threat actors can achieve a higher degree of stealth, efficiency, and operational persistence. The human operator is no longer the bottleneck, allowing for continuous, autonomous execution of malicious activities.
Cisco Talos has released its open-source research toolkit, CAIRN, to help track AI-integrated malware and provide actionable insights into this evolving threat landscape. The study of tools like CLOSEDQUORUM is crucial for understanding and defending against the future of AI-driven cyber warfare, which promises to be more autonomous and less reliant on human oversight.
Cisco Talos has released CAIRN, a research toolkit designed to hunt and classify AI-integrated malware by analyzing "cognitive artifacts" within binaries. This new methodology allows for the identification of malware that functionally integrates with, targets, or exploits AI systems without requiring binary execution, focusing instead on metadata such as prompt templates, API keys, and provider endpoints.