CLOSEDQUORUM: First Autonomous AI Malware Eliminates Human Oversight

• •CLOSEDQUORUM is the first malware to fully automate C2 without human involvement.
• •It targets LSASS for credential dumping and extracts passwords from browsers.
• •No confirmed deployment in the wild, but it represents a significant evolution in cyber threats.

CLOSEDQUORUM is identified as the first malware utilizing a fully autonomous command and control (C2) architecture, discovered by Cisco Talos through their CAIRN project. This malware operates without human involvement, leveraging a panel of large language models (LLMs) to execute decisions aimed at stealing user credentials and crypto wallets. While there is no confirmation of its deployment in the wild, it represents a significant evolution in cyber threats, as it can continue operations independently of human oversight. The malware targets Microsoft’s Local Security Authority Subsystem Service (LSASS) for credential dumping and also extracts saved passwords from popular browsers. This shift in attack methodology allows for increased speed and scale, as human operators are no longer a limiting factor. The malware is compiled in Google’s Go programming language and supports multiple LLM integrations. The implications of this technology could reshape offensive cyber operations, necessitating new defensive strategies.