Cisco Talos researchers identified a new malware strain dubbed ClosedQuorum, specifically targeting Windows 11 systems. The software is written in the Go programming language and operates autonomously without requiring direct human intervention or manual commands.
The malware leverages a suite of AI models, including Google Gemini, DeepSeek, Qwen, and Mistral, to determine its attack strategy. By utilizing a voting system based on reconnaissance data, the program decides which malicious actions to execute next on the compromised device.
Once the malware gains access to a machine, it focuses on high-value data extraction. Its primary objectives include stealing browser login credentials and harvesting cryptocurrency information. Additionally, the software is designed to maintain persistence on the host system and facilitate lateral movement across networks.
Talos experts noted that ClosedQuorum represents the first publicly documented Windows implant that delegates tactical command and control decisions to AI models. This integration significantly enhances the speed and scalability of malicious operations, allowing for more efficient data exfiltration.
