MediumNewsLLM-specific
New ClosedQuorum Windows malware uses AI for attack decisions
- Published
- Record updated
Summary
Cisco Talos reports ClosedQuorum, a Go-based Windows malware that delegates post-compromise decisions to a panel of AI models, including Google Gemini, DeepSeek, Qwen and Mistral AI. The models vote on actions such as steal, inject, persist and move, with DeepSeek holding priority on ties, and results are sent to operators via a Discord webhook. Talos has no confirmation of in-the-wild deployment, though binary artifacts link the developer to carding forum posts dating back to 2025.
Related items
- Infollm-gemini 0.37Same vendor · Simon Willison's Weblog
- InfoGoogle’s new Gemini model is better at understanding complicated questionsSame vendor · The Verge (AI)
- InfoNo, AI agents did not discover a previously unknown Maya siteSame vendor · The Verge (AI)
- LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)
- InfoJim Cramer: This is the bet you're making if you buy the Anthropic IPOSame vendor · CNBC Technology