The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM is a Windows-based malware implant that uses commercial large language models (LLMs) from DeepSeek, Qwen, Mistral, and Google Gemini as an autonomous command and control (C2) infrastructure. It delegates tactical decisions such as credential theft, process injection, and persistence to a panel of LLMs, which vote on the next action via a structured JSON schema. The malware targets user credentials and cryptocurrency wallets, exfiltrating stolen data via an operator-controlled Discord webhook using AES-256-GCM encryption and Base64 encoding. While the distributed version contains placeholder keys and is non-functional, development builds suggest a 'credentials-as-a-service' model where customized binaries are provided to operators.

AI-extracted · verify before operational use