Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there's no confirmation that it’s actually been deployed in the wild.
Researchers said they’ve found the first reported malware binary with an autonomous command-and-control (C2). The discovery comes with one caveat: there's no confirmation that it’s actually been deployed in the wild.
The Windows implant, which Cisco Talos researchers called ClosedQuorum, is deployed and then uses a panel of different LLMs (from DeepSeek, Qwen, Mistral, and Google Gemini) to determine the next steps in its attack. The final goal of the malware is to harvest user credentials and crypto wallets.
Though they didn’t see the malware actually being used in the wild, researchers came across artifacts from the binary that were used to connect the developer behind it to postings on criminal forums related to carding, dating back to 2025.
“This malware is a useful reference example of how attackers can collapse the decision space of a particular attack phase into a constrained set of choices, allowing AI models to provide reasoning and act independently,” said Ryan Fetterman with Cisco Talos in a post released Tuesday. “CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.”
How This Compares to “Traditional” C2 Architecture
Typically, attackers will operate the server infrastructure, which encompasses domains, IPs, protocols, and more. ClosedQuorum is different.
“Instead of a singular, unique C2 server, CLOSEDQUORUM calls up to four commercial LLM provider endpoints used by thousands of legitimate applications daily,” according to Fetterman.
The providers are queried one at a time before their responses are resolved into a single action via plurality voting, before the highest-count decision wins. If there’s tie, DeepSeek holds the deciding vote.
“Four providers increase the chance that the quorum reaches a decision even if one or two members are unresponsive, or for example, one model is hitting a guardrail,” said Fetterman. “If all models fail, the fallback decision is consensus: a string with no corresponding capability handler, causing the loop to sleep and retry rather than take a default action.”
There are several next-step “decisions” that are voted on, including steal (launching three credential/data theft functions simultaneously); inject (generating malicious code and hiding its execution inside another process using one of two injection techniques); persist (establishing persistence); and move (which had no handler in the analyzed sample).
Notably, researchers also highlighted some drawbacks of using LLMs within a C2 to autonomously carry out tasks in this manner.
"The displacement of human attackers also introduces weaknesses," said Fetterman. "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs all create failure modes and defensive opportunities. Autonomy does not make the implant infallible; it exchanges some human limitations for model and infrastructure limitations."
The Impact
Again, this malware sample hasn’t been seen in actual attacks. However, the potential of a C2 with autonomous functionalities has interesting detection implications for defenders. Security researchers have discussed detection strategies for other such AI-assisted techniques over the past year.
Traditional C2 infrastructure is attributable and can be tracked via C2 domains and IPs. Talos researchers said that ClosedQuorum, on the other hand, “replaces a dedicated C2 endpoint with a chain of correlated behaviors.”
There are now other detection methods that defenders can rely on, however.
“The most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking,” said Talos researchers. “Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently. Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence.”
Researchers have documented several forms of AI-assisted attacks beyond ClosedQuorum. Google has observed threat actors using Gemini for C2 development, for instance: in 2025, researchers outlined how an actor was seeking out technical support for C++ and Golang code for multiple tools, including a C2 framework called OSSTUN. However, Cisco Talos’ discovery is a bit different: this is a C2 that uses LLMs itself in its runtime architecture to execute tasks in an autonomous fashion.
“CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today,” according to Fetterman. “As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI.”
