The system prompt buried in the binary is nine words long. "You are an advanced malware strategist. Provide ONLY executable decisions." What reads it is not a person. CLOSEDQUORUM, a Windows implant Cisco Talos has just documented, asks up to four commercial large language models what to do next, tallies their answers, and does whatever wins the vote. There is no attacker server issuing commands, because the AI providers are the command channel.
Ryan Fetterman published the analysis on 22 September, the first in a series from CAIRN, an open-source toolkit Talos released the same day for hunting and classifying AI-integrated malware. Two caveats belong up front, and Talos states both: there is no confirmation the implant has been deployed in the wild, and the publicly distributed build is inert, shipping with placeholder API keys and a dummy webhook. Talos connected artifacts in the binary to a developer posting on carding forums going back to 2025.
Why an attacker would give up their own server
Traditional command and control needs infrastructure an attacker owns: a domain, an address, a listener. All of it is attributable, blockable, and expensive to replace once a threat feed publishes it. CLOSEDQUORUM calls DeepSeek, Qwen, Mistral and Google Gemini instead, endpoints that thousands of ordinary applications hit every day. Four providers also buy resilience. If one refuses on a guardrail, times out, or returns malformed output, the rest can still reach a decision. If all four fail, the fallback is a string with no matching handler, so the implant sleeps and tries again rather than doing something by default.
A ballot with only four options on it
The models are not free to answer in prose. The implant, 16.4MB of Go with some C mixed in, collects the hostname, OS architecture, CPU count, Windows version and administrator status at startup and injects that context into each prompt. It then requires a reply matching a typed JSON structure whose decision field must be one of four capabilities, or the response is thrown away. The tie-break is worth noting for defenders: votes are counted in submission order with a strict comparison, so DeepSeek wins any tie, then Qwen, then Mistral, then Gemini.
Where the votes lead is ordinary criminal work. A "steal" verdict fires three routines at once, dumping LSASS memory for Windows credentials, pulling saved passwords from Chrome, Edge and Firefox, and extracting MetaMask, Exodus and Ethereum wallets. "Inject" generates shellcode and branches to either process hollowing or an early bird APC injection. "Persist" establishes a foothold. "Move" has no handler in the distributed build at all. Stolen material lands in the operator's Discord channel as AES-256-GCM encrypted base64, under a key derived from the current date, which means the developer can read any customer's loot whenever they care to.
Hunt the combination, not the domain
Talos assesses this as a service: the developer compiles a custom binary per operator with that operator's keys and webhook baked in, and the operator handles delivery. Blocking AI provider domains is not the answer, since legitimate software talks to them. The useful signal is the combination. One Windows executable contacting several model providers in a short window, sending structured prompts carrying host context, reaching into LSASS or injecting into suspended processes, posting to a Discord webhook, and waking on a randomized five to fifteen minute cycle. Sample hashes include 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 and c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7.
Fetterman's framing is the part worth keeping. AI's effect on offense has mostly been speed and scale, with the operator still in the chair. What is different here is displacement: an entire phase of the attack moves off the human, and a system that does not sleep keeps making decisions when nobody is watching. That is a smaller leap than it sounds, because it only works where the choices can be reduced to a short list. It is also the same trend we saw when AI agents ran an intrusion end to end in under ten hours, and when criminals began renting models built to write malware on request. The dependencies cut both ways, though. Refusals, rate limits, predictable tie-breaking and a four-item menu are all failure modes a defender can work with.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.