Malware outsourced its attack decisions to a panel of four LLMs
Cisco Talos published a new way to hunt AI-integrated malware on Tuesday, and the first thing it caught is the part worth reading twice: a Windows implant that asks four commercial language models what to do next, and then does it.
Talos says CLOSEDQUORUM is the first publicly documented Windows implant to hand tactical command-and-control decisions to a panel of commercial models — DeepSeek, Qwen, Mistral and Google Gemini — and execute whatever the vote picks. The 16.4MB Go binary has no attacker-operated server behind it. Each active model votes on the next action from a fixed menu of implant capabilities: credential harvesting, process injection, WMI persistence, crypto-wallet theft. The votes are tallied, and the binary acts on the winner. The models are not free to answer in prose — the system prompt extracted from the binary tells them "You are an advanced malware strategist. Provide ONLY executable decisions," and the reply is deserialized straight into a Go struct that drives execution.
The tie-breaking is the detail that tells you how the thing was built. Ties resolve deterministically in a fixed provider order — DeepSeek first, then Qwen, Mistral and Gemini — because the code's maximum-finding loop takes the first-encountered top vote. If DeepSeek is unreachable, the deciding vote moves down the list. Nothing about that is clever, and it is exactly the kind of predictability that gives defenders something to work with.
Stolen material leaves the host AES-256-GCM encrypted and lands in the operator's Discord channel as base64 blocks, so past the initial delivery the campaign can run with nobody at the keyboard. Talos frames the change as effort displacement rather than speed: an entire phase of an intrusion moved off the human, who is bound by attention and working hours, onto a system that is not. It also notes the model panel behaves like the infrastructure it replaces — no attributable domain to block, because the implant is calling endpoints that thousands of legitimate applications use every day.
The honest caveat is that this is a demonstration, not a working campaign. The distribution build Talos analysed ships with placeholder API keys and a dummy webhook, and the researchers did not observe a complete end-to-end execution; they also call it unsophisticated and leave open whether it is a test. What they treat as significant is the precedent: encoding attack logic as model-readable context and converting structured model output directly into execution is now achievable with ordinary API access and off-the-shelf models. The failure modes are real too — provider refusals, rate limits, malformed output and hard dependence on commercial APIs all sit between the implant and its next move.
The toolkit that found it is the other half of the announcement. CAIRN (Cognitive Artifact Intelligence Research Network) is open source, works entirely from metadata — no binary downloads, no execution — and hunts AI-integrated malware by the artifacts its authors leave behind: embedded prompts, provider endpoints, API-key prefixes, jailbreak strings. It pulls candidates through up to 24 acquisition filters into a SQLite corpus, classifies them with three tiers of YARA rules, and clusters them by embedding similarity to surface families that share no obvious strings. Talos is clear that semantic clusters are leads, not attribution.
What to watch: whether the defensive industry treats "several LLM provider endpoints contacted alongside LSASS access and WMI persistence" as a detection signature, because that behavioural combination is the most durable signal here — domain blocking is not.
If a model panel can run an intrusion phase better than a tired human can, does security tooling need to start scoring model usage as an attack indicator? Tell us in the comments.
Sources: CAIRN (GitHub)
