CLOSEDQUORUM Windows Malware Leverages AI Voting for Command Execution

CLOSEDQUORUM is a novel Windows implant that replaces traditional hardcoded C2 infrastructure with a voting mechanism utilizing commercial AI services, including DeepSeek, Qwen, Mistral, and Google Gemini. Discovered by Cisco Talos, the malware transmits system telemetry and a predefined list of actions to these models, proceeding with the action that receives the highest consensus. The malware supports actions such as credential theft, code injection, and establishing persistence.

Although the publicly analyzed samples include placeholder values for API keys and Discord webhooks, the design represents a shift toward delegating attack logic to external AI services. The malware maintains operational visibility by posting decisions and stolen data to a configured Discord channel via webhooks. Persistence is achieved through Windows Update-themed Registry keys, scheduled tasks, and WMI event subscriptions. Defenders should monitor for anomalous outbound traffic to AI API providers originating from unauthorized endpoints, particularly when coupled with indicators of LSASS access or suspicious process injection.

Attack Chain

1. Execution of the CLOSEDQUORUM binary on the host system.
2. Collection of system metadata, including hostname, OS version, and administrator status.
3. Initiation of HTTPS requests to multiple AI API providers (e.g., DeepSeek, Qwen) to request tasking based on the gathered metadata.
4. Aggregation of AI model responses to determine the majority-voted action (steal, inject, or persist).
5. If 'steal' is selected, the malware performs LSASS memory dumping and exfiltration of browser and crypto wallet credentials.
6. If 'persist' is selected, the malware creates Registry Run keys, scheduled tasks, and WMI event subscriptions disguised as Windows Update processes.
7. Exfiltration of stolen data, split into encrypted 1,900-byte chunks, to the attacker via a Discord webhook.

Impact

The malware is designed to facilitate credential theft, persistence, and potential code injection on compromised Windows hosts. While Cisco Talos noted that the publicly available samples are currently non-functional due to missing API credentials, the underlying capability demonstrates a sophisticated approach to autonomous C2 and command orchestration. Potential impact includes mass credential harvesting, persistent backdoor installation, and the risk of automated lateral movement or payload deployment based on model-driven decision-making.

Recommendation

Prioritize detection and response based on the behavioral patterns associated with CLOSEDQUORUM.

• Enable monitoring for anomalous outbound HTTPS traffic to identified AI API providers (DeepSeek, Qwen, Mistral, Gemini, OpenRouter) from processes not authorized to interact with AI services.
• Implement Sysmon or EDR rules to detect LSASS memory access (Event ID 10) by non-security processes.
• Monitor for the creation of persistence mechanisms themed as 'WindowsUpdate' or similar system updates, specifically targeting the Run registry key and WMI event subscriptions.
• Inspect process creation logs for the execution of PowerShell scripts from paths within C:\Windows\Temp.
• Utilize the provided SHA-256 hashes to hunt for dormant or staged samples across the enterprise environment.