AI is transforming the landscape of cyber attacks, and the latest revelations from Cisco Talos illustrate just how far this trend has gone. The research team's findings highlight the emergence of a malware architecture dubbed CLOSEDQUORUM, which is striking in its ability to execute large segments of the attack process without any human oversight at all.
CLOSEDQUORUM represents what researchers are calling “LLM-as-C2,” an architecture that fully automates the command-and-control (C2) chain of remote cyber operations. This malware utilizes a panel of large language models (LLMs) to formulate the most effective strategies for credential theft.
Ryan Fetterman, a security researcher at Cisco Talos, emphasizes the significance of this transition. “This isn't simply enhancing human capabilities; it's a complete transfer of an attack phase from human operators to an automated system,” he noted on the company’s blog.
The removal of humans from the cyber attack equation significantly boosts speed and scalability. Since AI can operate continuously, it bypasses the limitations that human attackers face, such as fatigue and working hours. As Fetterman points out, “It does not go offline when the attacker sleeps.” However, it should be highlighted that there’s no current evidence of CLOSEDQUORUM being deployed in the wild.
An LLM Panel Making Executable Decisions
The discovery of CLOSEDQUORUM was facilitated by Cisco Talos’s newly launched Cognitive Artifact Intelligence Research Network (CAIRN), a tool designed to classify and track malware infused with AI. This malware compresses decision-making processes around specific attack phases into a limited set of options, enabling the AI to act autonomously.
One of the primary targets for CLOSEDQUORUM is Microsoft’s Local Security Authority Subsystem Service (LSASS), which involves dumping credentials—essentially extracting login information directly from memory. This malware also seeks to steal stored credentials from major web browsers like Chrome, Edge, and Firefox, and aims to siphon off cryptocurrency wallets, targeting platforms such as MetaMask and Ethereum.
Executing its malicious tasks is where CLOSEDQUORUM really stands out. Compiled in Go, the 64-bit executable can integrate up to four different LLMs—DeepSeek, Qwen, Mistral, and Google Gemini. Upon activation, it queries these models in sequence with the directive: "You are an advanced malware strategist. Provide ONLY executable decisions." The module then calculates their independent assessments and acts with the singular goal of pilfering user credentials.
The entire operation is designed to be self-sufficient; human input is not required at any point after deployment. The models convey context, decide on capabilities, and continuously execute decisions without needing further instructions. “The complete dynamic operation is delegated to the AI,” Fetterman explained. The voting system among the LLMs selects the most favored action based on their consensus, all while adhering to a precise JSON output structure, thus limiting their responses.
In instances of a tie, the malware defaults to a predefined preference order—favoring DeepSeek above the others. This design minimizes disruptions from any responses that may be unresponsive or malformed while improving the chances of valid decision-making outcomes. Interestingly, if all models fail to produce a viable choice, the system pauses and attempts to re-evaluate rather than blindly proceeding with an action.
Fetterman has characterized this architecture as a "credentials-as-a-service" model, where an individual deploying the malware can run a complete attack without being actively online. “They deploy the binary, and the LLM panel runs the attack,” he stated. "This scaffolding could be adapted to serve various adversarial aims."
A Brief Opportunity for Observing AI's Shift
With CAIRN, Cisco Talos has tackled AI-integrated malware hunting since July 2025, discovering that the nature of this autonomous framework evolves rapidly. “The shift from ‘LLM as optional feature’ to ‘fully autonomous multi-model consensus orchestrator’ occurred remarkably fast,” Fetterman observed.
The structure has been diluted into actual malicious code, with techniques such as CLOSEDQUORUM spreading to threat actors disconnected from the original codebase. “We may be observing a fleeting window of AI integration,” Fetterman noted, emphasizing how quickly this trend is becoming commonplace in adversarial software.
Specifically, CLOSEDQUORUM displays certain telltale signs: unexpected API traffic from Windows executables, structured decision-making prompts, timed executions, and communication with webhooks. Intrusions can be executed using readily available models paired with conventional API access.
Yet, this method isn't without vulnerabilities. Issues like model refusals, output errors, predictable tie-breakers, and reliance on public APIs can hinder the effectiveness of an attack.
“Autonomous systems aren’t infallible; they trade human weaknesses for machine limitations,” Fetterman cautioned. “The silver lining for defenders is that we are still at the nascent stages of this progression.”
