Cisco Talos finds CLOSEDQUORUM malware that picks its next move via four LLMs

Cisco Talos released CAIRN, an open-source framework for analyzing AI-integrated malware, and detailed CLOSEDQUORUM, the first publicly documented Windows implant to use LLMs for tactical command and control. Written in Go at 16.4MB, it votes on its next action — data theft, code injection or persistence — without an attacker-operated C2 server.

• CLOSEDQUORUM queries DeepSeek, Qwen, Mistral and Gemini, deciding by majority vote
• Ties favor DeepSeek first, then Qwen, Mistral and Gemini
• The implant is written in Go, weighs 16.4MB and needs no C2 server
• CAIRN sorts findings into three tiers: strings, behavioral artifacts and confirmed families