CLOSEDQUORUM Windows Malware
On September 22, Cisco Talos reported a new Windows malware called CLOSEDQUORUM, which is built to take orders from a vote of up to four AI models instead of an attacker's server. This malware is at least three months old, with Talos's analysis of the code dated June 17, 2026. The use of AI models in CLOSEDQUORUM makes it a significant threat to Windows users, as it can evade traditional detection methods and adapt to different environments. According to The Hacker News, the malware's ability to use AI models for decision making is a notable development in the threat landscape.
How the AI Vote Works in Windows Malware
CLOSEDQUORUM asks up to four commercial AI services - DeepSeek, Qwen, Mistral, and Google Gemini - what to do. With each request, the malware sends basic facts about the computer, such as its name, its Windows version, and administrator status. It also sends a fixed list of actions for the models to choose from: steal, inject, persist, and move. The models must answer in a set format, or their answer is thrown out. The malware counts the answers and carries out the action with the most votes. If no model gives a usable answer, it waits and tries again instead of picking an action by default. This approach allows the malware to dynamically adjust its behavior based on the environment it is operating in, making it more challenging to detect and mitigate.
Actions and Their Consequences for Windows Users
When the vote picks steal, the malware does three things at once: it dumps the memory of LSASS, the Windows process that holds login credentials; it copies saved passwords from Chrome, Edge, and Firefox; and it copies data from MetaMask, Exodus, and Ethereum crypto wallets. The inject choice runs code inside another program using a method called Early Bird APC injection, or process hollowing if the model asks for it. The persist choice sets up three ways for the malware to start again automatically: a value under the current user's Registry Run key, a scheduled task, and a WMI event subscription that starts it every 60 seconds. These actions can have severe consequences for Windows users, including the theft of sensitive information and the compromise of their systems.
Implications of AI-Powered Windows Malware
The use of AI models in CLOSEDQUORUM has significant implications for Windows users and defenders. The malware's ability to adapt to different environments and evade traditional detection methods makes it a challenging threat to detect and mitigate. Additionally, the use of commercial AI services raises concerns about the potential for abuse of these services by malicious actors. As the threat landscape continues to evolve, it is essential for defenders to stay vigilant and watch for behavior that is indicative of CLOSEDQUORUM's presence, rather than relying solely on blocking the domains of the AI services. The development of AI-powered malware like CLOSEDQUORUM highlights the need for defenders to stay up-to-date with the latest threats and to use a combination of traditional and behavioral detection methods to stay ahead of malicious actors.
What Defenders Can Look For to Detect CLOSEDQUORUM
Talos said defenders should watch for behavior rather than block the domains of the AI services. Legitimate programs may contact DeepSeek, Mistral, Gemini, Discord, or OpenRouter, but far fewer would contact several of them while also accessing LSASS, injecting code into suspended processes, or creating WMI persistence. Defenders can look for the following indicators of compromise: AI-service traffic from a Windows program that is not expected to use AI, similar requests sent to several AI providers within a short time, prompts that contain details about the computer or attack language, which are likely visible only with TLS inspection or to the AI provider, process injection, LSASS access, or new persistence, Discord webhook traffic from the same program or computer, and activity that repeats at random intervals of five to 15 minutes. By monitoring for these indicators, defenders can improve their chances of detecting and mitigating CLOSEDQUORUM.
Mitigation Strategies for CLOSEDQUORUM Windows Malware
To mitigate the threat of CLOSEDQUORUM, defenders can use a Snort rule published by Talos, which looks for the malware's prompts to the AI services. Additionally, a YARA rule published by Talos can be used to search VirusTotal's data about files. By understanding how CLOSEDQUORUM works and what actions it can take, defenders can better protect themselves against this sophisticated threat. The use of AI models in CLOSEDQUORUM highlights the need for defenders to stay up-to-date with the latest threats and to use a combination of traditional and behavioral detection methods to stay ahead of malicious actors. For more information on cybersecurity threats and mitigation strategies, visit the official Cisco Talos website.
Next Steps for Windows Malware Defense
CLOSEDQUORUM is a significant threat to Windows users, and its use of AI models to decide its next move makes it a challenging malware to detect and mitigate. Defenders must be vigilant and watch for behavior that is indicative of CLOSEDQUORUM's presence, rather than relying solely on blocking the domains of the AI services. The development of AI-powered malware like CLOSEDQUORUM is likely to continue, and defenders must be prepared to adapt their strategies to counter these emerging threats.
Related Coverage
- TASK#STOMP PowerShell backdoor steals documents, Wi-Fi passwords, and clipboard data
- JFrog Researchers Expose Critical Bifrost AI Gateway RCE Due to Default-Disabled Auth
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation