6 minhigh
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM is a first-of-its-kind Windows implant that delegates tactical C2 decisions to a panel of commercial LLMs, executing actions autonomously to steal credentials and crypto wallets. The implant queries DeepSeek, Qwen, Mistral, and Gemini APIs in sequence, using plurality voting to select among steal, inject, persist, or move actions. Credentials from LSASS, browsers, and crypto wallets are AES-256-GCM encrypted and exfiltrated via Discord webhook in 1900-byte segments. The distribution build contains placeholder keys; no in-the-wild deployment is confirmed.
Sens:▲ 24hConf:
IOCs9
6sha2561filename1file path1registry key
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block the six identified SHA256 hashes on endpoints and email gateways
- Alert on processes contacting multiple LLM provider APIs within five minutes
- Hunt for WindowsUpdate Registry Run key values under HKCU
- Monitor for PowerShell execution of scripts in C:\Windows\Temp\
Key Takeaways
- 16.4MB 64-bit Go binary compiled with Go 1.24.2, CGO enabled, targets amd64 Windows
- Four LLM providers queried sequentially with plurality voting; DeepSeek wins all ties
- Distribution build contains placeholder API keys and dummy webhook, rendering it non-functional
- Developer linked to criminal forum carding posts dating back to 2025
- AES-256-GCM exfil encryption uses date-derived key; developer can decrypt any operator's data
Attack Chain
- Initial Access: Operator deploys custom binary with injected LLM API keys and Discord webhook
- Execution: Implant collects system info, queries four LLM providers, and votes on next action
- Credential Access: LLM-selected steal action dumps LSASS, browser passwords, and crypto wallets
- Persistence: LLM-selected persist action creates Registry Run key, scheduled task, or WMI subscription
- Defense Evasion: ETW patched with RET, secondary payload time-keyed, 5-15 min randomized polling
- Exfiltration: Data AES-256-GCM encrypted, Base64-encoded, posted to Discord webhook in 1900-byte segments
Affected Systems
- Windows 64-bit (amd64) systems
- Chrome, Edge, Firefox saved credential stores
- MetaMask Chrome extension wallet data
- Exodus desktop crypto wallet (exodus.wallet)
- Ethereum local wallet storage
- Windows LSASS process memory
Detection Availability
- Published: YARA
- Platforms: CAIRN, Cisco Talos
YARA rule CLOSEDQUORUM_LLM_Autonomous_Implant provided in article body.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process injection, LSASS access, and persistence are EDR-detectable; LLM API calls blend with legitimate traffic. |
| Network Visibility | Low | LLM provider and Discord endpoints are legitimate services; TLS inspection needed to see prompt content. |
| Detection Difficulty | Hard | Individual indicators blend with legitimate activity; multi-behavior correlation required for detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Windows executables making API calls to multiple LLM providers within minutes while also accessing LSASS memory (T1003.001, T1102) | Process network connections and LSASS handle access events | Credential Access | Low — legitimate apps rarely combine these behaviors |
| Processes creating WMI event subscriptions and writing PowerShell scripts to C:\Windows\Temp\ (T1546.003, T1059.001) | WMI subscription creation and file write events | Persistence | Low — WMI subscriptions with temp scripts are rare |
| Process injecting shellcode via Early Bird APC into suspended processes at randomized intervals (T1055.004) | Process creation, handle operations, and APC queue events | Execution | Medium — some legitimate tools use APC injection |
| Process posting Base64-encoded data to Discord webhook in 1900-byte segments at one-second intervals (T1567.004, T1030) | Network egress to Discord webhook URLs with size patterns | Exfiltration | Medium — legitimate Discord bots may post similar data |
Required Log Sources
- Process creation events (Sysmon EID 1)
- LSASS access events (EID 10)
- Registry modification events (EID 13)
- WMI event subscription logs
- Network connection logs (EID 3)
- Scheduled task creation logs (EID 4698)
Key Behavioral Indicators
- Single process contacting multiple LLM provider APIs within short interval
- Discord webhook egress from process also accessing LSASS memory
- Registry Run key value named WindowsUpdate under current user hive
- PowerShell script written to C:\Windows\Temp\wmi.ps1 for WMI persistence
- EtwEventWrite function patched with single RET instruction in process memory
- Suspended process creation followed by APC queue and thread resume
Control Gaps
- Domain blocking ineffective; LLM provider endpoints are legitimate services
- TLS inspection required to detect offensive prompts in LLM API traffic
- Single-behavior alerts insufficient; multi-behavior correlation needed
- Date-derived AES key prevents interception-based decryption of exfil data
- Five-minute initial delay and randomized intervals may bypass sandbox analysis
False Positive Assessment
Medium — Legitimate applications contact LLM providers and Discord independently; correlation of multiple behaviors reduces false positives.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable TLS inspection for LLM provider API traffic from endpoint networks
- Block Discord webhook egress from non-browser, non-Discord processes
- Deploy EDR rules for LSASS access by non-system processes
- Alert on WMI permanent event subscription creation events
User Protection
- Remove saved passwords from Chrome, Edge, and Firefox browsers
- Secure crypto wallet recovery phrases offline; remove local wallet files when idle
- Enable browser credential encryption with strong master passwords
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping21 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
A newly discovered Windows malware program called CLOSEDQUORUM uses commercial artificial intelligence services to make its own attack decisions without a human operator. Instead of connecting to a dedicated control server, it asks AI models (like DeepSeek and Gemini) to decide whether to steal passwords, inject code, or establish persistence. Stolen data is encrypted and sent through Discord. No real-world attacks have been confirmed; the distributed version contains placeholder credentials and does not function as-is.
Additional IOCs
- File Hashes:
c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7(SHA256) - Development build hash from seven-day build chainc13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f(SHA256) - Development build hash from seven-day build chainf5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c(SHA256) - Development build hash from seven-day build chain5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb(SHA256) - Development build hash from seven-day build chaineddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5(SHA256) - Development build hash from seven-day build chain
- File Paths:
C:\Windows\Temp\wmi.ps1- WMI persistence PowerShell script dropped by implant
- Command Lines:
- Purpose: Create scheduled task for persistence | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn - Purpose: Execute WMI persistence script from temp directory | Tools:
powershell.exe| Stage: Persistence |powershell.exe C:\Windows\Temp\wmi.ps1
- Purpose: Create scheduled task for persistence | Tools:
- Other:
gohno-final.exe- Developer build filename with API keys baked in via ldflagsearlyburb.exe- Build filename referenced in YARA rule exfil channel comment
Showing defanged values
- filenamewmi.ps1PowerShell script dropped to C:\Windows\Temp\ for WMI persistence
- file_pathC:\Windows\Temp\wmi.ps1WMI persistence PowerShell script dropped by implant
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdatePersistence via Registry Run key with masqueraded name
- sha256250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7Primary development build hash referenced in YARA and analysis
- sha2565191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cbDevelopment build hash from seven-day build chain
- sha256c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86fDevelopment build hash from seven-day build chain
- sha256c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7Development build hash from seven-day build chain
- sha256eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5Development build hash from seven-day build chain
- sha256f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63cDevelopment build hash from seven-day build chain