Glonce

Cisco Talos uncovers CLOSEDQUORUM, malware run by AI consensus

securityThe Glonce editorsWired🔥75Glonce rating75Impact70Novelty75Relevance90Surprise65Players45Credibility82
Cisco Talos uncovers CLOSEDQUORUM, malware run by AI consensus

Cisco Talos published CAIRN (Cognitive Artifact Intelligence Research Network) on a Monday: an open-source framework meant to classify and track malware that has AI built into it. Lead researcher Ryan Fetterman says the idea is that AI integration leaves behind detectable traces, much like a fingerprint, that defenders can use to track a sample, classify it and study how it behaves over time.

Using CAIRN, the team identified CLOSEDQUORUM, a Windows hacking tool they describe as having fully autonomous command-and-control infrastructure. Rather than taking orders from a human operator, CLOSEDQUORUM polls up to four large language models, DeepSeek, Qwen, Mistral and Google Gemini, and acts on whatever consensus emerges from their answers. If one of the four services is unreachable, it simply queries the rest, so the loop stays closed with no point where a person steps in.

Talos found links between CLOSEDQUORUM and cybercriminal forums trading in credit-card fraud going back to 2025, and the malware is built to steal login credentials and cryptocurrency. The researchers could not confirm who wrote it, or whether it has actually been used in a real-world attack.

The backstory: in July 2025 the Ukrainian cybersecurity response unit CERT-UA warned about a phishing campaign using malware called LAMEHUG, which queried the model Qwen2.5-Coder-32B-Instruct through a Hugging Face API for its commands. Fetterman recalls expecting that case to trigger a wave of AI-enabled malware, so this summer he ran a retrospective and was surprised to find only about nine named AI-integrated malware families, some of them research proofs of concept rather than tools in use. Since standing up CAIRN and running it for a few months, he says he has found roughly 20 more examples.

Matt Olney, Cisco Talos's senior director of threat intelligence, frames the shift this way: attackers used to treat AI purely as a productivity tool, and now it is becoming an operational backend, letting them run more campaigns against more targets because they have what he calls a very intelligent box in the background that can be asked questions and give answers.

Key facts

  • Cisco Talos's open-source CAIRN framework identified CLOSEDQUORUM, Windows malware with fully autonomous, human-free command-and-control.
  • CLOSEDQUORUM polls up to four LLMs, DeepSeek, Qwen, Mistral and Google Gemini, and acts on their consensus; if one is unreachable it just asks the rest.
  • Researchers link the malware to credit-card-fraud forums active since 2025 and say it is built to steal login credentials and cryptocurrency, but could not confirm who wrote it or whether it has hit real targets.
  • Lead researcher Ryan Fetterman found only about nine named AI-integrated malware families in a summer retrospective, then roughly 20 more once CAIRN was running.
  • The precedent: in July 2025 CERT-UA flagged LAMEHUG, malware that queried Qwen2.5-Coder-32B-Instruct via a Hugging Face API for its commands.

Why it matters

As attackers fold agentic AI components into their tools, defenders have lacked a shared way to fingerprint and track the result. CAIRN gives Cisco Talos, and anyone who adopts the open-source framework, a method for tagging AI-integrated malware samples and spotting trends across them. CLOSEDQUORUM is the clearest example yet of what that shift looks like in practice: a hacking tool with no human in its command loop at all, taking its instructions from a vote among several LLMs. Olney's framing captures the stakes: AI has moved from a productivity aid for attackers to an operational backend that lets them run more campaigns against more targets.

Who it affects

Cybersecurity defenders and threat-intelligence teams gain a shared framework for classifying this category of malware instead of tracking each family in isolation. The four LLM providers whose public models CLOSEDQUORUM queries, DeepSeek, Qwen, Mistral and Google Gemini, are being used as an unwitting decision layer for the malware's next steps. Organizations exposed to CLOSEDQUORUM itself face credential and cryptocurrency theft, the payload Talos says the tool is built to carry out.

How to use it

CAIRN is open source, and Cisco Talos says it hopes the framework will be used widely to classify and analyze AI-integrated malware. It works by flagging AI-integration characteristics from a sample's metadata, tagging it with a unique ID, then comparing it against everything already in the CAIRN library to surface trends and connections. The source gives no pricing or licensing terms beyond its open-source release.

How solid is it

This is Cisco Talos's own published research, with named researchers and direct quotes, and it comes with real findings: an identified malware family, a working framework and a rough count of prior examples. It also comes with explicit gaps: the researchers could not identify CLOSEDQUORUM's author or confirm it has been deployed in a live attack, and Fetterman himself describes AI-integrated malware as still largely experimental for attackers, with the documented population in the dozens rather than a wave.

Risks and caveats

CLOSEDQUORUM is built to steal login credentials and cryptocurrency, and Talos ties it to credit-card-fraud forums active since 2025. Its multi-model voting design is itself a risk multiplier: because losing access to any single AI service does not stop it, there is no single point, human or otherwise, where the command chain can be cut. The claims about scope stop where the source's evidence stops: no confirmed developer, no confirmed victim, and no total count of malware samples in the CAIRN library beyond the roughly 20 additional examples Fetterman has found so far.

“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind. That gives us a signal that we can use to track these samples, classify them, and look at what's happening. What are attackers trying? What kind of emergent behaviors are we seeing? That's a valuable resource to the defensive community as these things become more mainstream.”

— Ryan Fetterman, security researcher at Cisco Talos who led development of CAIRN