Technical analysis of CLOSEDQUORUM: the malware using an AI quorum as C2

When headlines about CLOSEDQUORUM first hit, the coverage followed a familiar script: "AI malware independently decides how to destroy computers". Anyone who spends their days parsing logs, inspecting network traces, and debugging memory dumps learns quickly to skip the alarmist noise and read the actual research from Cisco Talos and threat feeds on AlienVault OTX.

The actual code tells a simpler, much more practical story. It is an experimental proof-of-concept (PoC) testing a straightforward idea: using commercial Large Language Model (LLM) APIs as a command-and-control (C2) channel, offloading the decision of which tactical step to run next to an automated panel of models.

In this article, I break down how CLOSEDQUORUM is put together, how its voting logic runs, why the current implementation falls flat in practice, and why behavioral EDR stops the attack regardless of network evasion.

What is CLOSEDQUORUM?#

Discovered by Cisco Talos during their CAIRN (Cognitive Artifact Intelligence Research Network) project, CLOSEDQUORUM is a Windows binary featuring an unconventional C2 mechanism.

Instead of reaching out to a dedicated attacker server, where an operator manually types commands or a script serves static payloads, it sends HTTPS requests to four commercial AI providers:

1. DeepSeek
2. Qwen (Alibaba)
3. Mistral AI
4. Google Gemini

The author attempted to achieve what Cisco Talos terms effort displacement (effort displacement): the implant surveys the local machine, sends that context to the model APIs, and executes whichever action collects the most votes.

[Compromised Host]
       │
       ├─ Telemetry: Processes, Privileges, Architecture, User
       │
       ▼
 [AI Dispatcher] ──── Concurrent HTTPS Queries ────┐
       │                                           │
       ├── DeepSeek API (Vote A + Tie-Breaker)     │
       ├── Qwen API (Vote B)                       │
       ├── Mistral AI API (Vote C)                 │
       └── Google Gemini API (Vote D)              │
                                                   │
                                                   ▼
                                         [Quorum Voting Engine]
                                                   │
                ┌──────────────────────────────────┴──────────────────────┐
                ▼                                                         ▼
         [STEAL / INJECT / PERSIST]                             [Discord Exfiltration]
         Majority tactical execution                            Webhook with AI reasoning

Anatomy of the quorum voting engine#

The author avoided having the models write arbitrary code on the fly. Anyone who has used LLMs to generate scripts knows that syntax errors and hallucinations will inevitably break runtime execution. Instead, the malware restricts its action space to four hardcoded commands:

How voting unfolds#

Once executed, the binary runs initial discovery:

• Queries the computer name, current user, and process integrity level.
• Checks running processes to verify whether it is running inside a virtual machine or sandbox.
• Builds a JSON payload with these details and asks all four APIs the exact same question: "Based on this host telemetry, which action is most effective: STEAL, INJECT, PERSIST, or MOVE?"

Each model returns its selection along with brief rationale:

• Simple Majority: If three or four models agree (for example, three votes for STEAL), that routine runs right away.
• Tie-Breaker: In a 2-2 tie, the code includes a hardcoded rule: DeepSeek casts the tie-breaking vote.
• Remote Telemetry: Once the vote settles, the malware sends a Discord webhook containing the winning action and the explanation each model supplied.

Why CLOSEDQUORUM fails in real-world scenarios#

Headlines make this look like a polished autonomous weapon. When I inspect the binary under a disassembler, the opposite is true: the code is brittle, slow, and full of half-finished logic.

1. High latency for C2#

In an active intrusion, command delivery must be fast or carefully staged asynchronously. CLOSEDQUORUM has to negotiate four distinct TLS 1.3 handshakes, wait for inference latency from four separate cloud platforms, and parse the responses. That adds 3 to 10 seconds of round-trip delay just to pick a single command. In offensive operations, that delay creates an obvious detection window.

2. Schema fragility and hallucinations#

LLMs do not guarantee strict deterministic output. If one API returns conversational courtesy text before the JSON block, or refuses the request due to content safety policies, the binary's string parser fails. Because the malware lacks robust error handling for unexpected responses, the main thread crashes.

3. Exposed API credentials#

To query the models, the binary requires API tokens. In the sample Cisco Talos retrieved, the developers left behind test keys and placeholder webhooks. If an attacker deployed this binary in the wild with real keys, automated sandboxes like VirusTotal or Hybrid Analysis would extract those tokens in minutes, leading to immediate account bans and payment tracebacks.

4. Incomplete code stubs#

The MOVE module does not even work. It is an empty function stub with no actual implementation. This confirms the analyzed sample was a testing harness, an experimental bench test to check if polling multiple APIs worked, rather than a mature tool deployed in active campaigns.

The genuine concern: network perimeter evasion#

Even with its implementation bugs, CLOSEDQUORUM highlights an evasion concept that network defenders must take seriously: using trusted cloud providers to mask outbound traffic.

Enterprise perimeter defenses (Firewalls, Secure Web Gateways, IDS) detect C2 traffic by looking for:

1. Connections to newly registered or low-reputation domains.
2. Self-signed or mismatched TLS certificates.
3. Periodic beaconing intervals to unknown endpoints.

When malware points its C2 traffic at public AI APIs, the connections route to high-reputation corporate domains with valid certificates:

• api.deepseek.com
• api.mistral.ai
• generativelanguage.googleapis.com

If an organization already uses commercial AI tools, this chatter blends into standard developer and employee HTTPS traffic. Without SSL inspection and payload inspection, perimeter IP and domain blocklists see nothing suspicious.

Defending against this attack class#

The main takeaway from CLOSEDQUORUM is straightforward: who issued the order does not change what the payload does. Whether an instruction to dump passwords came from a human operator or a quorum of LLMs, the operating system activity remains unmistakably malicious.

To protect systems against this class of threat, I rely on three core defenses:

1. LSASS memory protection#

The primary target of the STEAL routine is pulling hashes and plaintexts from lsass.exe. On Windows, I ensure two settings are enabled across endpoints:

• RunAsPPL (Protected Process Light): Prevents non-protected processes from reading LSASS memory.

# Enable PPL for LSASS via the Windows Registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1 -Type DWord

• Credential Guard: Uses virtualization-based security (VBS) to isolate NTLM and Kerberos credentials inside a secure Hyper-V container where host OS processes cannot read them, even with local admin rights.

2. Behavioral EDR (IOAs over IOCs)#

Matching static file hashes, like the 18 indicators listed on AlienVault OTX, only catches known binaries.

Modern enterprise EDR suites, such as CrowdStrike Falcon, focus on Indicators of Attack (IOAs). The sensor does not need to identify the IP address or reputation of the server issuing the command. When an unverified binary attempts Process Hollowing (MITRE T1055) or requests PROCESS_VM_READ against security authentication subsystems, CrowdStrike Falcon intercepts the execution chain directly in the kernel and blocks the action in real time. For teams managing Windows fleets that need proactive protection against ransomware and evasive C2 implants, that behavioral layer makes all the difference.

3. Hunting cognitive artifacts with CAIRN#

The open-source CAIRN project by Cisco Talos offers a practical angle for Threat Hunting: searching for cognitive artifacts compiled into binaries.

Instead of only checking standard PE headers, defenders should inspect suspicious binaries for:

• Known AI API endpoints embedded in cleartext or lightly obfuscated strings.
• Prompt templates packaged into binary data ("Given the following system information...").
• Custom JSON schemas tailored to parse model responses.

Indicators of Compromise (IOCs)#

For security teams needing to update detection rules in SIEM, EDR, or threat hunting routines, here are the SHA256 hashes cataloged by Cisco Talos and documented in the AlienVault OTX Pulse. These match the six experimental builds identified across the author's compile chain:

API endpoints targeted by the quorum#

• api.deepseek.com (Tie-breaker and quorum voting)
• api.mistral.ai (C2 action voting)
• generativelanguage.googleapis.com (Google Gemini API — C2 action voting)

Threat Intelligence Reference: AlienVault OTX Pulse 6ab431db415b8cd13de69a7e

Conclusion#

CLOSEDQUORUM is slow, brittle, and broken in its current state. Still, it signals where offensive tooling is heading: turning to trusted cloud infrastructure to bypass perimeter controls.

For infrastructure engineers, the defensive playbook does not change: enforce least privilege, lock down Windows credential processes, and run behavioral EDR on the host. When endpoint protections are tuned properly, whatever method the malware used to pick its next move will not matter.

See also

Cybersecurity What is EPP (endpoint protection platform) security and EPP protection

Cybersecurity What to look for in a next-generation antivirus (NGAV)

Cybersecurity Fast javascript security triage: hunting backdoors and vulnerabilities with grep

This post is licensed under CC BY-NC.