A Windows malware strain called ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral models to autonomously choose post-compromise actions on infected hosts, according to Cisco Talos researchers1. Cisco Talos describes it as the first publicly documented Windows implant to delegate tactical command-and-control decisions to a panel of AI models.
The Go-based implant operates without human operator commands. After initial compromise, it feeds reconnaissance data to the four models and applies a voting system to select its next move. When votes are tied, DeepSeek holds priority for the final call, followed by Qwen, Mistral, and Google Gemini.
Constrained action set
The models choose from a predefined menu of decisions. The "steal" action runs LSASS credential dumping, browser credential theft across Chrome, Edge, and Firefox, and cryptocurrency-wallet extraction targeting MetaMask, Exodus, and Ethereum wallets simultaneously. The "inject" action generates shellcode and deploys it via process hollowing or Early Bird APC injection. A "persist" action triggers the malware's persistence module. A "move" option for lateral movement is listed but has no corresponding handler in the analyzed build and cannot execute.
Exfiltrated data is sent to operators through a Discord webhook, meaning the attack chain is fully automated after initial delivery.
Operational status unclear
Cisco Talos says it has no confirmation of in-the-wild deployment. The analyzed binary contains placeholder API credentials and a dummy Discord webhook. Cisco Talos says it is unclear whether ClosedQuorum is a test or experiment. Artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
Cisco notes the system may face challenges when rate limits are hit, output is malformed, or commercial APIs are temporarily unavailable. Despite those constraints, Cisco Talos says the approach adds greater speed and scaling potential to malicious operations and warns that ClosedQuorum represents an architectural shift toward attack-chain automation.
Discovery method
Cisco Talos discovered ClosedQuorum through Cairn, an open-source toolkit it released to help researchers track and analyze AI-integrated malware.
ANALYSIS The multi-model voting architecture treats the models as a redundant decision layer inside the implant itself, reducing single-point-of-failure risk if one API goes down. The absence of a working lateral-movement handler and the placeholder credentials suggest the tooling is still under development, but the architectural pattern is now documented and available for imitation.