Loading story…
Cisco Talos reported CLOSEDQUORUM, a 64-bit Go-based Windows implant that delegates tactical command-and-control decisions to a plurality vote among commercial LLMs including DeepSeek, Qwen, Mistral, and Google Gemini. Rather than depending on a conventional attacker-controlled C2 server or continuous operator input, the malware can use the models' structured responses to select actions such as credential theft, persistence, and process injection—including techniques that can execute malicious code within legitimate processes and evade process-based defenses.
The observed sample was an inert template containing placeholder API keys and a dummy Discord webhook, so Talos could not validate end-to-end execution or deployment in the wild. Build artifacts suggest customized variants may embed provider credentials and Discord endpoints for exfiltration; the implant targets LSASS memory, browser-stored credentials, and cryptocurrency wallets, encrypting and Base64-encoding data before segmented Discord delivery. Defenders should correlate anomalous traffic to multiple AI-provider APIs with LSASS access, process-injection behavior, persistence changes, and Discord communications.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos shared an open-source framework designed to identify, classify, and analyze malware and hacking tools that use AI chatbots or agentic AI components. Talos said applying the framework identified an unusual AI-guided malware instance, though the excerpt did not name the malware, operators, or targets.
The malware previously referred to as BALZAK was renamed CLOSEDQUORUM.
Development-build artifacts associated with CLOSEDQUORUM reportedly link its developer to criminal-forum carding posts dating to 2025.
Cisco Talos discovered the Go-based 64-bit Windows CLOSEDQUORUM binary through its CAIRN project and described it as the first publicly documented Windows implant using commercial LLMs for tactical command-and-control decisions. The observed distribution sample was an inert template with dummy API keys and a Discord webhook, so Talos did not confirm in-the-wild deployment or end-to-end execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.talosintelligence.com
Open sourcewired.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro disclosed a previously undocumented Linux implant, **Quasar Linux RAT** (`QLNX`), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including **npm**, **PyPI**, **Git**, **AWS**, **Kubernetes**, **Docker**, **Vault**, **Terraform**, **GitHub CLI**, `.env` files, SSH keys, browser data, and even `/etc/shadow`, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments. The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said `QLNX` runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including **`LD_PRELOAD`**, **systemd**, **crontab**, **init.d**, **XDG autostart**, and `.bashrc` injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using `gcc`, then hides processes, files, and ports through a two-tier design that combines a userland `LD_PRELOAD` rootkit with an **eBPF** kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.
Jun 29, 2026
Researchers linked intrusions at telecom organizations in South Asia and an ISP in West Asia to **CloudComputating**—also tracked as **BackdoorDiplomacy** and **Faking Dragon**—after uncovering a new modular malware framework called **QSC**. The framework was delivered through **Quarian v3** (also known as **Turian**) and consists of Loader, Core, Network, Command Shell, and File Manager components designed to keep most functionality in memory. In a later campaign, the attackers also deployed a new Golang backdoor, **GoClient**, to execute commands, manage files, capture screenshots, and conduct post-compromise reconnaissance. The operators used QSC and GoClient to enumerate compromised environments, identify domain controllers and file servers, steal **`NTDS.dit`** using shadow copies, and move laterally with **WMIC** and stolen domain administrator credentials. Researchers said the activity showed a tactical shift toward a plugin-based framework with internal pivoting and port-forwarding to route command-and-control traffic through compromised hosts. The attribution to CloudComputating was made with medium confidence based on Quarian infrastructure, malware overlaps, shared tooling, and consistent operational patterns.
Jun 29, 2026
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026