CLOSEDQUORUM: An Autonomous Windows Implant Using Multiple LLMs for Attack Decisions

Cisco Talos has reported a new autonomous Windows implant called CLOSEDQUORUM. This implant is designed to send structured requests containing host information to multiple large language models (LLMs) and then execute an attack action selected by plurality voting. The implant is written in Go and targets Windows endpoints.

The implant collects host details such as the hostname, OS, CPU count, presence of administrator privileges, and target processes. It then sends this information and up to four selectable attack actions to up to four LLMs, including DeepSeek, Qwen, Mistral, and Gemini. The implant receives JSON responses from these LLMs and determines the action with the highest vote count for execution.

The attack actions include credential dumping from LSASS memory, collection of browser credentials and cryptocurrency wallet files, process injection via Early Bird APC or Process Hollowing, and persistence via Registry Run keys, scheduled tasks, or WMI event subscriptions. The implant encrypts collected data with AES-256-GCM, Base64-encodes it, splits it into 1,900-byte segments, and sends the segments to a Discord Webhook at one-second intervals.

The implant is deployed separately by the attacker with an API key and Discord Webhook. The public version contains dummy credentials and was not observed to execute in real-world scenarios. Success conditions include the attacker executing the implant on the endpoint with valid LLM API keys and a Discord Webhook. Failure conditions include unknown executable files being blocked with application control and communication to unnecessary AI APIs and Discord Webhooks being restricted.