CLOSEDQUORUM: a malware that votes on four models to choose its next move

Cisco Talos describes the first documented implant whose tactical control is entrusted to a panel of business models, and publishes CAIRN to track this type of code.

On 22 September, Cisco's Talos team released the analysis of CLOSEDQUORUM, a 16.4 MB Windows Go-based implant that does not receive its orders from a conventional server. At each stage, he successively questions four business models — DeepSeek, Qwen, Mistral and Gemini — and executes the most popular action. In the event of equality, the priority is for DeepSeek, then for Qwen, Mistral and Gemini in this order.

The capabilities are nothing new: theft of identifiers via LSASS, browser passwords, cryptocurrency portfolios, process injections, registry persistence, planned tasks and WMI subscriptions, exfiltion to Discord encrypted in AES-256-GCM. The novelty lies in the shift of effort: phases that demanded a human operator are now continuing without it.

Talos found no real deployment. The parsed binary contains fake API keys and bogus webhooks, making it inoperative as it is. The laboratory has published in parallel CAIRN, an open toolbox designed to identify and classify malware that delegates its decisions to language models.