CLOSEDQUORUM, a Windows malware binary, represents the first publicly documented implant to apply AI models for tactical command and control. After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets without human operator involvement. The complete dynamic operation is delegated to the AI, collapsing the decision space into a constrained set of choices. CLOSEDQUORUM's architecture supports up to four LLM provider integrations, each queried in sequence, their independent verdicts tallied, and the binary acts based on their judgment.
The process involves querying four commercial LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini, with a structured prompt containing host context or offensive capability language. The system prompt is constrained to a typed JSON schema representing a specific attack-decision language, requiring executable decisions only. Responses are deserialized into a Go struct, routing to capability modules of main.main: steal, inject, persist, move. The LLM must emit a valid JSON object matching a known type, with a decision field that maps to a specific capability. If all models fail, the fallback decision is consensus: a string with no corresponding capability handler, causing the loop to sleep and retry.[/subscribe_to_unlock_form]
CLOSEDQUORUM, a Windows malware binary, represents the first publicly documented implant to apply AI models for tactical command and control. After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets without human operator involvement. The complete dynamic operation is delegated to the AI, collapsing the decision space into a constrained set of choices. CLOSEDQUORUM's architecture supports up to four LLM provider integrations, each queried in sequence, their independent verdicts tallied, and the binary acts based on their judgment.
The process involves querying four commercial LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini, with a structured prompt containing host context or offensive capability language. The system prompt is constrained to a typed JSON schema representing a specific attack-decision language, requiring executable decisions only. Responses are deserialized into a Go struct, routing to capability modules of main.main: steal, inject, persist, move. The LLM must emit a valid JSON object matching a known type, with a decision field that maps to a specific capability. If all models fail, the fallback decision is consensus: a string with no corresponding capability handler, causing the loop to sleep and retry.[emaillocker id="1283"]
The operating model of CLOSEDQUORUM appears to operate as an operator-configured service rather than malware deployed directly by its developer. The publicly observed distribution binary is an inert template, requiring customization for each operator through injected LLM API credentials and a Discord webhook. Stolen credentials arrive in the operator's Discord channel, AES-256-GCM encrypted with a daily-rotating key derived from the message timestamp. This is obfuscation, not true confidentiality separation between developer and operator.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.006 | Command and Scripting Interpreter | Python |
| Persistence | T1543.003 | Create or Modify System Process | Windows Service |
| Defence Evasion | T1036.005 | Masquerading | Match Legitimate Resource Name or Location |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1567.002 | Exfiltration Over Web Service | Exfiltration to Cloud Storage |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Command & Control | B0030 | C2 Communication |
| Discovery | E1083 | File and Directory Discovery |
| Exfiltration | E1020 | Automated Exfiltration |
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
The following reports contain further technical details:
[/emaillocker]