ClosedQuorum: When AI Starts Making Decisions for Malware Attacks
AI is no longer being used only to help attackers write code or automate tasks. A new Windows malware example shows how AI models can also be used to make decisions during an attack.
Cybersecurity researchers have identified a Windows malware called ClosedQuorum, which uses multiple Large Language Models (LLMs) to determine what action it should take after compromising a system.
The discovery highlights an emerging cybersecurity trend: AI-driven attack automation, where parts of the attack chain can operate with significantly less human intervention.
According to Cisco Talos, ClosedQuorum uses a panel of AI models—including DeepSeek, Qwen, Mistral, and Google Gemini—to evaluate predefined attack options and select the next action.
While researchers have not confirmed widespread real-world deployment of ClosedQuorum, the architecture demonstrates how AI could increasingly become part of offensive cyber operations.
What Is ClosedQuorum?
ClosedQuorum is a Go-based Windows malware implant designed to delegate tactical command-and-control decisions to multiple AI models.
Unlike traditional malware that waits for commands from an attacker-controlled Command-and-Control (C2) server, ClosedQuorum can query AI models and use their responses to determine its next step.
The system works through a voting mechanism.
Multiple AI providers independently provide a decision, and the malware selects the action receiving the most votes. Cisco Talos describes this architecture as a form of LLM-based C2, because the AI providers effectively become part of the malware's decision-making infrastructure.
This creates a significant shift in how automated attacks could operate.
How Does AI-Powered Malware Make Decisions?
ClosedQuorum does not give the AI models unlimited control.
Instead, the malware restricts the models to a predefined set of possible actions. These include capabilities such as:
-
Steal — targeting credentials and cryptocurrency wallet information
-
Inject — performing process injection techniques
-
Persist — attempting to maintain access to the compromised system
-
Move — representing potential lateral movement functionality
The AI therefore acts more like a decision engine than an unrestricted autonomous attacker.
This distinction is important.
The malware defines what it can do, while the AI helps determine which available action should happen next.
From AI-Assisted Attacks to Autonomous Attack Chains
For years, attackers have used AI to accelerate activities such as:
In these scenarios, however, a human operator generally remains involved.
ClosedQuorum demonstrates a different concept.
Instead of using AI simply as an assistant, AI is integrated into the operational decision-making process.
Cisco Talos describes this broader development as a shift toward attack-chain automation, where more parts of an attack can operate without continuous human involvement.
The potential model can be represented as:
Reconnaissance → AI Decision → Attack Action → Data Collection → Exfiltration
The more stages that become automated, the less frequently an attacker may need to intervene manually.
Why This Matters for Enterprise Cybersecurity
The significance of ClosedQuorum is not necessarily the malware itself.
The more important issue is the architecture behind it.
Traditional security models often assume that an attacker requires infrastructure, commands, and human intervention to coordinate different stages of an intrusion.
AI can potentially change that assumption.
An attack could increasingly become:
Adaptive
The next action can be selected based on information discovered during the intrusion.
Automated
Certain decisions can be made without waiting for an operator.
Scalable
One operator may potentially manage more compromised systems with less manual effort.
Persistent
Automated processes can continue operating even when a human attacker is not actively monitoring the campaign.
Cisco Talos describes this concept as “effort displacement”—moving portions of an attack from the human operator to the system itself.
AI Becomes Part of the Attack Surface
Another important aspect is that ClosedQuorum does not necessarily require a traditional dedicated C2 server for every decision.
Instead, it can communicate with legitimate AI provider infrastructure.
This creates a challenge for defenders.
Blocking every connection to major AI services is generally impractical because legitimate employees and applications may also use them.
Therefore, organizations need to look beyond simple domain or IP blocking.
The security question becomes:
Why is this endpoint communicating with multiple AI services—and what else is it doing at the same time?
For example, suspicious activity could become more significant when AI-related network traffic occurs alongside behaviors such as:
-
Access to sensitive credential stores
-
LSASS access
-
Process injection
-
Persistence mechanisms
-
Browser credential access
-
Cryptocurrency wallet access
-
Unexpected Discord webhook communication
Cisco Talos recommends focusing on behavioral characteristics and combinations of indicators, rather than relying solely on blocking individual AI-provider domains.
AI-Powered Malware Is Still Facing Limitations
The use of AI does not automatically make malware unstoppable.
ClosedQuorum also demonstrates several potential weaknesses in AI-dependent attack infrastructure.
AI APIs may experience:
-
Rate limits
-
Timeouts
-
Malformed responses
-
Service interruptions
-
API availability issues
These dependencies can affect the reliability of an automated attack chain.
In addition, the version publicly analyzed by Cisco Talos contained placeholder API credentials and a dummy Discord webhook, meaning researchers did not observe a complete end-to-end operational deployment from that public sample.
Cisco Talos also states that there is currently no confirmation that ClosedQuorum has been deployed broadly in real-world attacks.
What Is the Difference Between Agentic AI and AI-Assisted Malware?
This development also highlights an important distinction.
AI-Assisted Cyber Attack
AI helps a human attacker perform a task.
Human → AI → Task
For example, an attacker asks AI to generate a script or analyze information.
Agentic AI Attack
AI can participate in a multi-step workflow and make decisions based on available information.
Goal → Observe → Decide → Act → Evaluate → Repeat
ClosedQuorum represents an early example of this second direction within malware architecture, although its decision space is still constrained by predefined capabilities.
This is why Agentic AI Security is becoming increasingly relevant for enterprise cybersecurity.
How Organizations Should Prepare
Organizations should consider adapting security strategies for an environment where AI may become part of both legitimate workflows and malicious attack chains.
1. Monitor AI Usage Across the Environment
Organizations should understand which AI services are being accessed, by which applications, users, and endpoints.
Unexpected AI-provider communication from unknown executables should receive additional scrutiny.
2. Strengthen Endpoint Detection
Endpoint security should detect behavioral combinations rather than relying only on known malware signatures.
Activities such as credential dumping, process injection, persistence creation, and unusual network communication can provide valuable detection signals.
3. Apply Least Privilege
Reducing unnecessary privileges can limit what malware can access after initial compromise.
This is particularly important for credentials, administrative tools, sensitive applications, and critical infrastructure.
4. Monitor Identity and Credential Activity
Because credentials remain a valuable target for attackers, organizations should monitor unusual authentication behavior, credential access, and privilege escalation.
5. Secure AI Adoption
As employees and applications increasingly use AI services, organizations should establish controls around:
AI security should not be treated as a separate issue from cybersecurity.
It should become part of the organization's broader risk management strategy.
The Bigger Picture: AI Is Changing the Attack Surface
ClosedQuorum is an important example of where cybersecurity may be heading.
The evolution can be viewed as:
Traditional Malware
Human-controlled execution
↓
AI-Assisted Malware
AI helps generate or optimize malicious activity
↓
AI-Enabled Malware
AI becomes integrated into specific attack functions
↓
Autonomous Attack Components
AI begins making decisions within parts of the attack chain
The industry is still at an early stage of this evolution.
However, Cisco Talos' research into ClosedQuorum and its broader CAIRN project shows that security researchers are already tracking malware that integrates AI into operational workflows.
Conclusion
ClosedQuorum demonstrates an emerging cybersecurity reality: AI can become part of the decision-making layer of an attack—not just a tool used by the attacker.
Although there is currently no confirmation of widespread real-world deployment, the architecture provides an important warning for organizations preparing for the next generation of cyber threats.
As AI becomes increasingly integrated into business operations, cybersecurity strategies must evolve accordingly.
Organizations need visibility across endpoints, identities, applications, networks, cloud environments, and AI services to detect abnormal behavior before an automated attack chain can escalate.
The future of cybersecurity is not only about defending against AI-powered attacks. It is about understanding how AI changes the entire attack surface.
Is your organization ready for AI-driven cyber threats?
Visit BigFishTec to explore cybersecurity solutions designed to help organizations manage evolving cyber risks.
www.bigfishtec.com
