Malware 'CLOSEDQUORUM' Leverages AI Models for Autonomous Decision-Making
Researchers have identified CLOSEDQUORUM, a novel Windows malware that uses AI models like Gemini and Mistral to autonomously decide its next malicious action, bypassing the need for traditional command-and-control servers.
A newly discovered Windows malware sample, dubbed CLOSEDQUORUM, represents a significant evolution in cyber threats by delegating critical decision-making to artificial intelligence models. Instead of relying on a human operator or a dedicated command-and-control (C2) server to dictate its actions, CLOSEDQUORUM queries AI models to determine its next move, which could range from stealing sensitive data to establishing persistence or hiding within legitimate processes.
This innovative approach was uncovered by researchers at Cisco Talos as part of their CAIRN research project. While the specific delivery vector for CLOSEDQUORUM remains unknown, it appears operators deploy customized versions themselves. Crucially, there is no confirmed widespread deployment in the wild; the reported capabilities highlight a potential future threat rather than an active campaign impacting numerous victims. The publicly available build examined by Talos contained placeholder credentials and a dummy reporting address, indicating it was a research artifact or an early-stage development.
CLOSEDQUORUM's unique architecture involves sending information about the infected system—such as its operating system, processor count, and administrator privileges—to multiple AI models, including DeepSeek, Qwen, Mistral, and Gemini. These models are presented with a limited set of predefined actions, and the malware tallies the votes to select the most popular choice. This voting mechanism ensures that the malware operates within the boundaries set by its creator, rather than exhibiting truly independent, unbounded reasoning.
If the AI models vote to steal data, CLOSEDQUORUM is designed to search for Windows login credentials, saved browser passwords, and cryptocurrency wallet information. Other potential actions include injecting malicious code into other running processes or setting up mechanisms for future execution. While the current build includes a network traversal capability, it lacks a functional handler, limiting its ability to execute a full-scale intrusion without further operator intervention.
The reliance on public AI services for tactical decisions marks a departure from traditional malware, which typically communicates with attacker-controlled C2 servers. This shift makes detection based on specific C2 server addresses less effective. Instead, defenders are advised to monitor for sequences of suspicious behaviors.
Security teams should look for unusual Windows programs that simultaneously contact multiple AI providers, followed by actions such as accessing Windows credential memory, injecting code into other processes, establishing persistence, or communicating with a Discord webhook. Talos also noted that the malware exhibits an initial delay followed by activity at irregular intervals of five to fifteen minutes, a pattern designed to evade simple detection rules and mimic legitimate AI interactions.
While the current iteration of CLOSEDQUORUM has limitations, such as potential interruptions from model refusals or rate limits, its design poses a significant warning. Future variants could overcome these weaknesses, enabling malware to autonomously choose its next steps and adapt its operations even when the operator is offline. The broader trend of attackers leveraging AI for offensive operations is accelerating, making it imperative for the cybersecurity community to understand and prepare for these evolving threats.
Researchers have linked development artifacts to an individual active on carding forums, but this connection does not confirm an active campaign or identify victims. The malware's proposed reporting mechanism uses a Discord webhook, and its date-derived encryption key could limit operator privacy. However, the core innovation—AI-driven autonomous decision-making—is a capability that defenders must now account for.