The Closed Quorum: Inside the first reported autonomous AI C2 implant

Summary

Cisco Talos documented CLOSEDQUORUM, described as the first publicly reported Windows implant to delegate tactical command and control to a panel of commercial large language models. After deployment the binary queries up to four LLM providers, tallies their votes to choose its next action, and executes the result without a human operator or a dedicated attacker-run C2 server.^[1]

Talos states there is no confirmation of in-the-wild deployment. The publicly observed distribution binary is an inert template with placeholder API keys (dummy_api_key) and a dummy Discord webhook, so a complete end-to-end execution was not observed; development builds nonetheless demonstrate build-time injection of provider credentials and an apparent credentials-as-a-service distribution model.^[1]

The implant is a 16.4MB Go executable carrying conventional offensive capabilities — LSASS dumping, browser credential theft, crypto wallet extraction, process injection, multiple persistence mechanisms, ETW patching, and Discord webhook exfiltration encrypted with AES-256-GCM — but its distinguishing feature is treating LLM provider endpoints as the C2 layer to achieve autonomous, operator-independent decision making.^[1]

Attack chain

1. Initialization and host profiling: gatherSystemInfo() captures hostname, OS architecture, CPU count, Windows version, and admin status during initialization; these values form the static TARGET context injected into each LLM prompt, while target_process refreshes each cycle. A five-minute initial delay and randomized 5–15-minute polling intervals reduce sandbox exposure.^[1]
2. Autonomous decision loop (LLM-as-C2): The ModelOrchestrator queries up to four providers (DeepSeek, Qwen, Mistral, Gemini) one-by-one with a constrained JSON decision schema. Responses are aggregated as a []LLMDecision slice and resolved by interModelDiscussion() via plurality voting; ties are broken deterministically in favor of DeepSeek, then Qwen, Mistral, Gemini. If all models fail, the fallback 'consensus' has no handler and the loop sleeps and retries.^[1]
3. Capability execution: The winning Decision routes to capability modules: 'steal' invokes lsassDump(), dumpBrowserCredentials(), and extractCryptoWallets() together; 'inject' calls generateShellcode() then branches to process hollowing (injectProcess/PEB-walk) or Early Bird APC injection (earlyBirdInject); 'persist' dispatches establishPersistence(). Persistence includes a Registry Run key WindowsUpdate value, a scheduled task via schtasks.exe, and a permanent WMI event subscription executing C:\Windows\Temp\wmi.ps1.^[1]
4. Staging and exfiltration: LSASS dumps, browser databases, and wallet files are staged under C:\Windows\Temp, encrypted with AES-256-GCM using a key derived from the current date, Base64-encoded, split into 1,900-byte segments, and posted to an operator-controlled Discord webhook at one-second intervals. The winning decision, reasoning, and attack telemetry are also sent to Discord in real time.^[1]

Disclosure timeline

How it works

CLOSEDQUORUM replaces attributable, blockable C2 infrastructure with calls to up to four commercial LLM provider endpoints. The models are constrained to a typed JSON schema (decision: inject|persist|steal|move) via a system prompt reading 'You are an advanced malware strategist. Provide ONLY executable decisions.' Each provider's Decision value increments a map counter and the highest-count decision is executed; invalid or off-schema responses are discarded, reducing model output to a constrained set of executable choices.^[1]

The multi-provider design provides both aggregation and resilience against individual refusals, timeouts, or guardrails. Tie-breaking is fully deterministic: the max-finding loop iterates decisions in submission order with a strict '<' comparison, so DeepSeek holds the deciding vote, falling through to Qwen, Mistral, then Gemini. If all providers fail, the fallback 'consensus' string maps to no handler, causing the loop to sleep and retry rather than take a default action.^[1]

The binary mixes Go and C (CGO_ENABLED=1) to make direct Windows system calls. It suppresses ETW telemetry by overwriting EtwEventWrite with a single RET, stores a secondary payload encrypted with a key derived from the current system time (environmental keying), and derives the AES-256-GCM exfil key from the current date — obfuscation the developer could reverse since the date is always knowable, rather than true confidentiality separation.^[1]

Indicators of Compromise

Key takeaways

• CLOSEDQUORUM demonstrates 'effort displacement' — transferring an entire attack phase from a human operator to an autonomous model-driven loop — which Talos frames as a distinct third dimension of AI's offensive impact beyond speed and scale.^[1]
• Using commercial LLM endpoints as C2 removes the attributable, blockable server infrastructure defenders traditionally track, but introduces new failure modes: provider refusals, rate limits, malformed output, predictable deterministic tie-breaking, and dependence on commercial APIs.^[1]
• Despite the novel autonomy layer, the implant relies on well-known techniques (LSASS dumping, APC/hollowing injection, registry/scheduled-task/WMI persistence, ETW patching, Discord webhook exfil), so behavioral detection of that correlated activity remains the most durable defense.^[1]
• The artifact is assessed as an early, limited example distributed as an inert template under an apparent credentials-as-a-service model, giving defenders an open window to build detections before autonomous operations become more capable and widespread.^[1]

Defensive actions

• Prioritize behavioral detection over domain blocking, correlating LLM-provider API traffic from an unexpected Windows executable with offensive host behaviors.: Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently; far fewer contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence, making the combination the distinguishing signal.^[1]
• Hunt for the correlated behavior chain: near-simultaneous requests to multiple model providers, Discord webhook communication from the same process, LSASS access, process injection, WMI/scheduled-task persistence, and repeated execution at randomized 5–15-minute intervals.: CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors that no single indicator fully identifies but whose combination is distinct.^[1]
• Deploy the CAIRN YARA rule and monitor for the binary-level anchors (hardcoded system prompt, LLM decision schema, and unstripped DWARF function names such as main.ModelOrchestrator and main.interModelDiscussion).: Talos published a YARA rule and build-chain SHA256 hashes; binary-level string and DWARF-name matches require direct file scanning while metadata anchors surface in sandbox verdicts.^[1]
• Where feasible, use TLS inspection or provider-side telemetry to surface structured prompts containing host context or offensive-capability language.: The malicious structured prompts injecting host TARGET context are only visible through TLS inspection or provider telemetry, per Talos.^[1]