The End of the Human Bottleneck: CLOSEDQUORUM and the Rise of Autonomous Breaches
AI-generated image · US National Wire
A new Windows implant leverages a 'quorum' of LLMs to dictate post-compromise actions, signaling a shift toward cyber-attacks limited only by model reasoning speed rather than operator latency.
For years, the cadence of a cyber-attack has been dictated by the human. Even the most sophisticated intrusions are subject to the biological constraints of the operator: the need for sleep, the limits of cognitive load, and the friction of manual decision-making.
As The Register first reported, the discovery of CLOSEDQUORUM—a Go-based Windows malware—represents a fundamental shift in command-and-control (C2) architecture. According to Cisco Talos, CLOSEDQUORUM is the first publicly documented Windows implant to utilize Large Language Models (LLMs) to autonomously select post-compromise actions.
**Opinion: The Era of the Autonomous Breach**
CLOSEDQUORUM is a proof of concept for the 'autonomous breach.' In traditional attacks, 'dwell time' is often extended by the latency of the human operator. With the integration of LLMs, the bottleneck shifts from human attention to the reasoning speed of the model.
As Cisco Talos analyst Ryan Fetterman noted on Tuesday, an AI system can continue operating even when the attacker is asleep. This 'effort displacement' allows an intrusion to scale in speed and volume at a tempo human defenders are not equipped to match.
**The 'Quorum' Logic**
CLOSEDQUORUM queries up to four LLM providers to determine its next move: Google Gemini, DeepSeek, Qwen, and Mistral. The malware employs a voting system; in the event of a tie, it follows a strict hierarchy of precedence, prioritizing DeepSeek, followed by Qwen, Mistral, and finally Gemini.
Fetterman described the process as a closed session where "no humans are admitted," with the binary acting based on the tallied independent verdicts of the four models.
**The Malware's Toolkit**
The models are limited to "executable decisions" via predefined capability modules. According to the system prompt extracted by Cisco Talos, the models are told, "You are an advanced malware strategist," and choose from:
* **Steal:** Dumps LSASS memory for Windows credentials, extracts browser passwords from Mozilla Firefox, Microsoft Edge, and Google Chrome, and steals cryptocurrency wallet data from Ethereum, Exodus, and MetaMask. * **Inject:** Generates shellcode and executes malicious code via Early Bird injection or process hollowing. * **Persist:** Establishes persistence on the compromised device.
**Deployment and Detection**
Cisco Talos researchers have not yet observed CLOSEDQUORUM deployed in the wild, though binary artifacts link the developer to carding forums dating back to 2025. Talos believes the developer provides customized executables containing the operator's LLM API keys and Discord webhook at compile time. Stolen data is sent to Discord, encrypted via AES-256-GCM with a daily rotating key.
Fetterman suggests that behavioral characteristics are the most effective detection strategy. While legitimate apps may contact Discord or providers like OpenRouter, Mistral, Gemini, and DeepSeek independently, few do so while simultaneously accessing LSASS, creating WMI persistence, or injecting into suspended processes.
To combat such threats, Cisco Talos has released the CAIRN (Cognitive Artifact Intelligence Research Network) toolkit as an open-source repository for the hunting and tracking of AI-integrated malware.