Attackers are increasingly exploiting AI's capabilities for enhanced speed and efficiency, as evidenced by a new threat identified by Cisco Talos. Their research highlights the emergence of CLOSEDQUORUM, a malware that automates significant portions of the attack cycle without human intervention, marking a shift in how cybercriminals will operate.
CLOSEDQUORUM is noted as the first “LLM-as-C2” architecture, leveraging a network of large language model (LLM) judges to identify and execute optimal strategies for stealing credentials. “This goes beyond augmenting an operator's capabilities; it transitions an entire phase of the attack from human control to autonomous execution,” said Ryan Fetterman, a security researcher at Cisco Talos, in a recent blog post.
The removal of humans from the decision-making loop eliminates traditional bottlenecks associated with mental fatigue, attention limits, and working hours, allowing the malware to function continuously. “It doesn’t go offline when the attacker takes a break,” Fetterman added, which underscores the malware’s potential for sustained assaults.
An Autonomous Decision-Making Structure
CLOSEDQUORUM was discovered using Cisco Talos' new Cognitive Artifact Intelligence Research Network (CAIRN) toolkit, which is designed to investigate and track AI-integrated malware. The malware condenses decision-making into a framework where AI operates independently across specific attack phases.
Specifically, CLOSEDQUORUM targets the Local Security Authority Subsystem Service (LSASS) within Windows to extract both domain and local credentials. Moreover, it can execute credential theft on popular browsers, siphoning saved passwords, and seeks to harvest cryptocurrency wallet information, including MetaMask and Ethereum.
Intelligence from these models is encoded in a context that the system can interpret, turning insights into executable commands. This malware is compiled in Go and supports up to four LLM integrations: DeepSeek, Qwen, Mistral, and Google Gemini.
Upon deployment, CLOSEDQUORUM engages its panel of models in a sequential querying process, asking them to operate under the direction: “You are an advanced malware strategist. Provide ONLY executable decisions.” The models then vote on actions based on their collective wisdom, with the option receiving the majority of votes executed automatically. Notably, all interactions are formatted in a structured JSON, limiting responses to executable decisions alone, which enhances operational efficiency.
In cases of a tie in suggested actions, a deterministic system follows a preference order favoring DeepSeek, optimizing the decision-making process even with potential model downtime. This design reduces reliance on any single model, thereby increasing the robustness of decision-making.
Fetterman describes CLOSEDQUORUM as a “credentials-as-a-service” model, indicating that human operators need not be active for the malware to execute its campaign. “The attacker can simply deploy the binary, and then the LLM panel manages the attack autonomously,” he stated, suggesting that this framework might soon be adapted for a variety of malicious purposes.
Navigating AI's Rapid Transition
The discovery of CLOSEDQUORUM was made possible through CAIRN, which was launched today as an open-source toolkit aimed at enhancing detection and classification of AI-integrated malware. CAIRN operates on a “metadata-first” approach, generating structured relationships among various artifacts to aid in identifying linked malware families.
Samples of malware are submitted to VirusTotal for extraction and indexing, allowing AI-related artifacts to be classified based on diverse attributes such as behavioral patterns and resource metadata. This approach enables cybersecurity teams to track evolving malware trends and operational connections effectively.
Cisco Talos has been utilizing CAIRN for malware research since July, and Fetterman emphasizes the rapid evolution occurring within autonomous frameworks. “Within just a year, we've seen a transition from ‘LLM as an optional feature’ to a fully autonomous model that requires no human oversight,” he remarked.
Features of CLOSEDQUORUM include API traffic patterns stemming from unanticipated Windows executables, and specific structured prompts indicating operational capabilities. Intrusions can be executed utilizing existing models and standard API access. However, this technique does introduce vulnerabilities: model refusals, output errors, and reliance on commercial API responses that could hinder successful execution.
“Autonomy doesn’t make this malware foolproof; it simply trades human limitations for those of the models themselves,” Fetterman concluded, suggesting that defenders still have the opportunity to prepare for and counter these emerging threats.
