The Closed Quorum: Inside the first reported autonomous AI C2 implant

1. Executive summary

Cisco Talos has published the first documented Windows implant, tracked as CLOSEDQUORUM, that delegates tactical command-and-control decisions to a voting panel of commercial large language models (DeepSeek, Qwen, Mistral, Google Gemini) instead of an attacker-operated C2 server. The 16.4MB Go binary carries a full credential- and crypto-wallet-theft capability set: LSASS memory dumping via MiniDumpWriteDump, browser credential theft from Chrome, Edge and Firefox, wallet theft from MetaMask, Exodus and Ethereum wallet paths, process injection (Early Bird APC and process hollowing), and three persistence mechanisms including a permanent WMI event subscription. Exfiltration runs over an operator-controlled Discord webhook, AES-256-GCM encrypted with a date-derived key. Talos has no confirmation of in-the-wild deployment; the public distribution build is inert, with placeholder API keys and a dummy webhook, and all findings are single-sourced to Talos static analysis. The bottom-line risk for EMEA financial services is low today but the architecture matters: C2 over legitimate LLM provider APIs defeats domain- and IP-based C2 blocking, and the credential-theft payload is aimed squarely at corporate browsers and domain credentials held in LSASS.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. There is no confirmed incident, no exploited vulnerability, and no in-the-wild deployment; the item is a research disclosure about a malware architecture. Clients who deploy the detection content in §4 and §6 are exercising existing ICT risk-management obligations, but no article in the regulatory reference is triggered by a fact distinctive to this item.

3. Technical analysis & attack chain

CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable compiled in Go. Its defining design choice is that it treats LLM provider endpoints as the C2 infrastructure. Instead of a dedicated, attributable, blockable C2 server, the implant calls up to four commercial LLM APIs (api.deepseek.com, Qwen, api.mistral.ai, Google Gemini, with openrouter.ai also present in analysed builds) that thousands of legitimate applications contact daily. A Discord webhook serves as the operator's reporting and exfiltration channel.

Confirmed attack chain, from Talos static analysis:

1. Deployment. The binary is distributed as an inert template: all LLM API credentials initialise to dummy_api_key and the Discord webhook to dummy_webhook_url. Development builds show the developer bakes real provider credentials into each operator's customised executable at build time (GoReSym build info shows -ldflags injection of deepseekAPIKey and geminiAPIKey into a build named gohno-final.exe). Talos assesses a credentials-as-a-service model: each operator gets a distinct binary and a distinct exfil channel.
2. Initialisation. gatherSystemInfo() captures hostname, OS architecture, CPU count, Windows version and admin status. These populate the TARGET: %s context substituted into every LLM prompt at runtime. The system-info component is static; target_process refreshes each decision cycle. A five-minute initial delay and randomised 5 to 15-minute polling intervals reduce exposure to short-lived sandbox analysis.
3. Quorum query. The ModelOrchestrator queries each active provider in sequence via main.queryLLM(model, prompt). The system prompt extracted from the binary reads: "You are an advanced malware strategist. Provide ONLY executable decisions." Responses are deserialised into a Go struct and aggregated as a []LLMDecision slice.
4. Vote resolution. main.interModelDiscussion() tallies each provider's Decision field into a map[string]int counter; plurality wins. Ties resolve deterministically in the priority order DeepSeek, Qwen, Mistral, Gemini, because the max-finding loop iterates in submission order with a strict < comparison, so the first-encountered maximum wins. If all models fail, the fallback decision is the string consensus, which has no capability handler; the loop sleeps and retries.
5. Action execution. The winning Decision routes to capability modules in main.main: - steal runs lsassDump(), dumpBrowserCredentials() and extractCryptoWallets() simultaneously. LSASS dumping enables SeDebugPrivilege and calls MiniDumpWriteDump. Browser theft targets Chrome and Edge Login Data and Firefox logins.json. Wallet theft hits MetaMask (Chrome extension profile), Exodus (exodus.wallet) and Ethereum wallet paths (ethPath). - inject calls generateShellcode() then branches on exploit_type: process_hollow routes to injectProcess() (PEB-walk hollowing: locate the suspended process's image base, overwrite its entry-point region, resume the thread); anything else routes to earlyBirdInject() (create a suspended process, write dynamically generated shellcode into its memory, queue the payload with NtQueueApcThread, resume execution). - persist dispatches to establishPersistence(). - move has no handler in the distribution build. The LLM must emit valid JSON matching the schema decision: "inject"|"persist"|"steal"|"move" or the response is discarded. The Reasoning field preserves the model's rationale at execution time.
6. Persistence (three mechanisms). A WindowsUpdate value under the current user's Registry Run key; a scheduled task created via schtasks.exe; and a permanent WMI event subscription triggering through a system-performance query every 60 seconds. The WMI mechanism writes a script to a path consistent with C:\Windows\Temp\wmi.ps1 and executes it with powershell.exe, leaving an on-disk artifact.
7. Defence impairment. The implant overwrites EtwEventWrite with a single RET instruction to suppress ETW telemetry. A secondary payload is stored encrypted, with a decryption key derived from the current system time so it cannot be recovered outside the expected temporal condition. Windows Update-themed registry, WMI filter and consumer names blend with legitimate system activity.
8. Staging and exfiltration. LSASS dumps, browser databases and wallet files are copied to staging locations under C:\Windows\Temp\ before transmission. Collected files are encrypted with AES-256-GCM using a symmetric key derived from the current date, Base64-encoded, split into 1,900-byte segments and posted to the Discord webhook (cdn.discordapp.com in memory-pattern domains) at one-second intervals. The webhook also carries real-time attack telemetry: selected action, target_process, exploit_type, evasion_method, payload_config.

Confidence caveats. Every technical claim above is single-sourced to Cisco Talos static analysis of the binary; Talos did not observe a complete end-to-end execution because the distribution build is non-functional as distributed. There is no confirmation of in-the-wild deployment. Talos connected the developer to criminal-forum carding postings dating to 2025 through binary artifacts, but no named actor is identified and no MITRE ATT&CK group attribution exists; treat any attribution as unconfirmed. The date-derived AES key means the developer's infrastructure could decrypt an operator's exfiltration, which Talos characterises as obfuscation rather than true developer/operator separation.

4. Mitigation & containment

No client is known to be affected. These actions harden against the architecture class and prepare detection coverage.

P1, within 24 hours:

• Hunt for the correlation, not the domains. Legitimate hosts may contact DeepSeek, OpenRouter, Mistral, Gemini or Discord independently; far fewer should contact several of them while also accessing LSASS, injecting into suspended processes or creating WMI persistence. Run a 7-day lookback joining egress DNS/HTTP to those provider endpoints with LSASS-access and process-creation telemetry on the same host.
• Deploy the YARA rule in §6 to endpoint scanning and the file hashes in §5 to EDR and SIEM lookback. The seven hashes represent the developer's build chain over seven days of development; a hit indicates the CLOSEDQUORUM family, not necessarily an active operator build.
• Verify controls that block unapproved outbound connections to LLM provider APIs and Discord CDN from standard user workstations. CLOSEDQUORUM has no dedicated C2 domain to block; egress allow-listing to business-approved SaaS is the containment that applies.

P2, within 72 hours:

• Confirm LSASS protection: enable Credential Guard or the RunAsPPL policy, and verify EDR blocks handle-open attempts on lsass.exe, which defeats the MiniDumpWriteDump path even if the implant executes.
• Audit WMI persistence on endpoints: permanent event subscriptions, filters and consumers, especially any system-performance query on a 60-second interval whose consumer launches powershell.exe against a script under C:\Windows\Temp. Remove and alert on any found.
• Check the Run key HKCU\...\Run for a WindowsUpdate value and schtasks.exe-created tasks with Windows Update-themed names from user contexts.

P3, within 7 days:

• Restrict browser credential storage: disable saved passwords in Chrome and Edge via enterprise policy on privileged and trading workstations, since dumpBrowserCredentials() reads Login Data directly.
• Review egress policy for api.deepseek.com, openrouter.ai, api.mistral.ai, Gemini endpoints and cdn.discordapp.com from endpoints that have no business need, and baseline normal volumes so the 1,900-byte one-second-interval POST pattern is anomalous.
• Add the Sigma rule in §6 to the detection pipeline and tune against the correlation hunt from P1.

5. Indicators of compromise

All indicators are single-sourced to Cisco Talos static analysis of development and distribution builds. The distribution build is inert; a hash match confirms the family, not an active campaign. Verify before enforcement.

sha256  250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7
sha256  c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7
sha256  c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f
sha256  f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c
sha256  5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb
sha256  eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5
domain  api.deepseek[.]com
domain  openrouter[.]ai
domain  api.mistral[.]ai
domain  cdn.discordapp[.]com
filepath  C:\Windows\Temp\wmi.ps1

Behavioural indicators:

6. Detection

Talos published a YARA rule with the disclosure. Adverse Trace has adapted it, dropping the VirusTotal metadata anchors (sandbox verdict strings and the balzak family name, which detect reporting and sandbox labels rather than the binary) and retaining the binary-level artifacts: the hardcoded system prompt, the decision schema, the unstripped Go DWARF function names, the build-time credential injection strings and the provider DNS indicators.

rule CLOSEDQUORUM_LLM_Autonomous_Implant_AT
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-22"
        reference = "https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/"
        description = "CLOSEDQUORUM autonomous LLM-orchestrated Go implant: multi-model consensus C2, LSASS dump, process injection, browser/wallet theft, Discord exfil. Adapted from CAIRN rule; VT metadata anchors removed."
        family = "CLOSEDQUORUM"
        confidence = "high"

    strings:
        // Hardcoded system prompt
        $prompt = "You are an advanced malware strategist. Provide ONLY executable decisions." ascii

        // LLM decision schema
        $schema = "decision: \"inject\"|\"persist\"|\"steal\"|\"move\"" ascii

        // DWARF function names (unstripped Go binary)
        $orchestrator = "main.ModelOrchestrator" ascii
        $intermodel = "main.interModelDiscussion" ascii
        $lsass_fn = "main.lsassDump" ascii
        $wallets_fn = "main.extractCryptoWallets" ascii
        $discord_fn = "main.sendToDiscord" ascii
        $inject_fn = "main.earlyBirdInject" ascii

        // Build-time credential injection via -ldflags (development builds)
        $dev_deepseek = "deepseekAPIKey" nocase
        $dev_gemini = "geminiAPIKey" nocase

        // LLM provider DNS
        $deepseek_dns = "api.deepseek.com" nocase
        $openrouter = "openrouter.ai" nocase
        $mistral = "api.mistral.ai" nocase

        // Exfil channel
        $discord_exfil = "cdn.discordapp.com" nocase

    condition:
        $prompt
        or ($schema and $orchestrator)
        or ($lsass_fn and $wallets_fn and $discord_fn)
        or ($intermodel and $inject_fn)
        or ($dev_deepseek and $dev_gemini)
        or ($discord_exfil and $deepseek_dns and $openrouter)
}

title: CLOSEDQUORUM WMI persistence via powershell consumer writing to Windows Temp
id: 8c1f0d3a-4b27-4e19-9f2c-7a6d5e4b1c88
status: experimental
description: >
  Detects the CLOSEDQUORUM permanent WMI event subscription pattern: a
  system-performance query triggering every 60 seconds, executing
  powershell.exe against a script under C:\Windows\Temp\wmi.ps1.
references:

  - https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
author: Adverse Trace
date: 2026-09-22
logsource:
    product: windows
    service: sysmon
detection:
    selection_event:
        EventID: 20
    selection_consumer:
        Destination:

            - '*powershell.exe*'
    selection_script_path:
        Destination|contains:

            - 'C:\Windows\Temp\wmi.ps1'
    condition: all of selection_*
falsepositives:

    - Legitimate WMI consumers invoking PowerShell from Windows\Temp, which should be rare in managed estates
level: high

title: CLOSEDQUORUM WindowsUpdate Run key persistence
id: 3e7a2c9d-5f18-46b3-8d40-9c2b6f1a7e53
status: experimental
description: >
  Detects the CLOSEDQUORUM persistence value: a Run key entry named
  WindowsUpdate created under the current user hive.
references:

  - https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
author: Adverse Trace
date: 2026-09-22
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 13
        TargetObject|contains|all:

            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - 'WindowsUpdate'
    condition: selection
falsepositives:

    - Genuine Windows Update components do not register under the user Run key with this name
level: high

7. Sources

• Cisco Talos, "The Closed Quorum: Inside the first reported autonomous AI C2 implant", https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/, 2026-09-22

8. Adverse Trace position

We assess the immediate risk to EMEA financial services as low: there is no confirmed in-the-wild deployment, the public build is inert, and every finding is single-sourced to Talos static analysis, so clients should verify before enforcement. The strategic risk is higher than the tactical one. CLOSEDQUORUM proves that a bounded attack phase can run without an operator and without attributable C2 infrastructure, using commercial LLM APIs that egress allow-lists treat as legitimate SaaS; domain and IP blocking, the backbone of conventional C2 defence, does not apply to this architecture. The credential-theft payload is directly relevant to financial services: LSASS dumps yield Windows domain credentials, and browser-stored passwords remain a common exposure on corporate endpoints. We will track the CAIRN series for subsequent AI-integrated malware disclosures, monitor for any operator builds with live API keys appearing in the wild, and update clients if the behavioural correlation in §4 produces hits or if a second source corroborates deployment.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.