Loading malware…
CLOSEDQUORUM is a Go-based, 64-bit Windows infostealer implant that delegates bounded post-compromise tactical decisions to commercial large language models. It supplies host information to DeepSeek, Qwen, Mistral, and Google Gemini, validates their structured responses, and uses plurality voting to select among predefined actions rather than receiving continuous tasking from a dedicated attacker-controlled command-and-control server. Ties are resolved through a fixed provider priority, and the implant waits and retries when no usable responses are returned.
Its theft functionality includes LSASS memory dumping, extraction of saved credentials from Chrome, Microsoft Edge, and Firefox, and collection of MetaMask, Exodus, and Ethereum wallet data. Other implemented capabilities include shellcode generation, process hollowing, Early Bird APC injection, and Windows persistence, including WMI event subscriptions. A lateral-movement option exists in the decision schema but has no handler in the analyzed public build. CLOSEDQUORUM reports model decisions and rationales through Discord webhooks and encrypts stolen data with AES-256-GCM before exfiltrating it through the same service.
Cisco Talos identified CLOSEDQUORUM through its CAIRN research project. The publicly analyzed build contains placeholder AI-service credentials and a dummy Discord webhook, preventing end-to-end operation as distributed. In-the-wild deployment, a delivery mechanism, and victim targeting have not been confirmed. Its decision loop depends on external AI services and can be interrupted by provider refusals, rate limits, unavailable APIs, or malformed responses.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
File path C:\Windows\Temp\wmi.ps1 Script path consistent with the implant’s WMI persistence mechanism.
« T1053.005 — Scheduled Task/Job: Scheduled Task (Persistence) »
« T1059.001 — Command and Scripting Interpreter: PowerShell (Execution) »
« T1053.005 — Scheduled Task/Job: Scheduled Task (Persistence) »
Talos also identifies WMI persistence creation among the behaviors defenders can correlate with CLOSEDQUORUM's network activity.
« T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence) »
« T1053.005 — Scheduled Task/Job: Scheduled Task (Persistence) »
The inject decision invokes shellcode generation then selects an injection mechanism.
Inject generates shellcode and then uses process hollowing or Early Bird injection to execute malicious code.
Other selections can invoke Early Bird APC injection.
A process_hollow selection routes execution to a process-hollowing implementation.
Talos also identifies WMI persistence creation among the behaviors defenders can correlate with CLOSEDQUORUM's network activity.
« T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence) »
« T1027 — Obfuscated Files or Information (Defense Evasion) »
« T1036.005 — Masquerading: Match Legitimate Resource Name or Location (Defense Evasion) »
The inject decision invokes shellcode generation then selects an injection mechanism.
Inject generates shellcode and then uses process hollowing or Early Bird injection to execute malicious code.
Other selections can invoke Early Bird APC injection.
A process_hollow selection routes execution to a process-hollowing implementation.
« clé dérivée de la date courante » and « T1480.001 — Execution Guardrails: Environmental Keying »
« Délai initial de 5 minutes (évasion sandbox) » and « Intervalles d’exécution aléatoires de 5 à 15 minutes »
« ETW désactivé (EtwEventWrite écrasé avec RET) »
The steal decision simultaneously launches three theft functions: LSASS credential dumping for Windows domain and local credentials.
LSASS process memory for Windows domain credentials. Standard Mimikatz-style extraction
« Wallets crypto : MetaMask ... Exodus (exodus.wallet), Ethereum (ethPath) »
It aims to take Windows and browser passwords and cryptocurrency wallets... File name exodus.wallet Exodus wallet file referenced among collection targets.
Cryptocurrency wallet files from MetaMask, Phantom, and the standard wallet directories for Bitcoin Core, Ethereum, and Solana.
Saved browser credential theft targeting Chrome, Edge, and Firefox.
It also copies... data from MetaMask, Exodus, and Ethereum crypto wallets.
During initialization, CLOSEDQUORUM gathers information including ... current target process.
During initialization, CLOSEDQUORUM gathers information including hostname, operating system architecture, CPU count, Windows version, administrative privilege status, and current target process.
Each of the four models receives a structured prompt containing: What files are present in standard wallet directories
« Délai initial de 5 minutes (évasion sandbox) » and « Intervalles d’exécution aléatoires de 5 à 15 minutes »
«извлекает данные криптокошельков MetaMask, Exodus и Ethereum».
« Les données volées sont chiffrées AES-256-GCM ... encodées en Base64, découpées en segments »
“Instead of awaiting instructions from a human operator or dedicated C2 server, the malware consults up to four commercial large language models ... and uses plurality voting to choose its next action.”
The interesting part is the exfil channel: Discord webhooks... They look like legitimate HTTPS traffic to a major platform.
CLOSEDQUORUM is designed to delegate tactical decisions to commercial LLM services ... rather than relying on continuous human tasking or a traditional attacker-controlled C2 server.
« encodées en Base64 »
Once the voting resolves, CLOSEDQUORUM runs the winning action and encrypts the output with AES-256-GCM.
« données volées sont chiffrées AES-256-GCM »
Stolen credentials land in the operator's Discord channel and are AES-256-GCM encrypted with a daily rotating key that the operator derives from the message timestamp.
« découpées en segments de 1 900 octets »
«похищенные у жертв данные передаются в этот же канал через веб-хук [Discord]».
Stolen information is encrypted using AES-256-GCM and transmitted to the operator through Discord.
« exfiltrées vers un webhook Discord opérateur »
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.