Overview
- Researchers found ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral APIs to analyze reconnaissance and vote on the next action without a human operator.
- The malware runs on Windows, is written in Go, and uses a voting order that gives DeepSeek tiebreak priority followed by Qwen, Mistral, and Gemini.
- The AI panel can choose from a fixed menu of actions — steal (LSASS, browser, crypto‑wallet theft), inject (shellcode via process hollowing or Early Bird APC), persist (run persistence module), and move (lateral movement not implemented in the analyzed build).
- The sample exfiltrates stolen data to a Discord webhook but contained placeholder API credentials and a dummy webhook, so researchers treat it as a demonstration rather than confirmed wide use.
- Experts warn the design speeds autonomous attacks yet depends on commercial model APIs that can fail under rate limits or outages, creating both new risks and opportunities for defenders to disrupt attacks by targeting API access and model-related telemetry.