A tie in CLOSEDQUORUM's four-model vote hands the decision to DeepSeek

CLOSEDQUORUM's command loop runs a vote in a fixed order. The implant sends information about the infected machine to DeepSeek, Qwen, Mistral and Google Gemini in sequence. Each model answers with a structured choice from a constrained menu of actions. The implant tallies the answers and executes the option with the most votes ^[14]. Cisco Talos describes the four-provider design as redundancy for a provider that refuses the request, times out or returns malformed output, and notes that DeepSeek takes a tie because the code checks responses in a fixed order ^[15].

Four voters make ties cheap. A 2-2 split produces no winner, and neither does a four-way disagreement, so on both paths the check order awards the action to DeepSeek ^[16]. The implant pays four network calls there and decides like one model.

CAIRN hunts the traces that kind of dependency leaves. It searches metadata for provider endpoints, embedded prompts, API-key prefixes, local-model runtimes, AI-analysis evasion strings and function-calling syntax paired with offensive capability ^[9]. Imports run YARA rules and land in a SQLite corpus, and findings sort into three tiers: basic AI artifacts, then behavioral context such as a provider endpoint appearing alongside command-and-control behavior, then a known operational family where the evidence supports attribution ^[10]. Semantic clustering and relationship graphs let an analyst start from one file and reach related samples and infrastructure without executing each candidate ^[11].

An implant built like CLOSEDQUORUM has to carry the artifacts on that list. Four provider endpoints, key handling and function-calling code sit in the same 16.4 MB Go binary as the credential theft, browser-password collection and wallet extraction ^[18][13].

The population figures need more care than the case study does. Fetterman, who previously led Splunk's SURGe research group and co-created the PEAK Threat Hunting Framework, named the project for the stone stacks that mark a trail ^[3][2]. He expected CERT-UA's July 2025 report on LAMEHUG, which fetched commands from Qwen2.5-Coder-32B-Instruct over a Hugging Face API, to be the start of a wave ^[4]. By summer 2026 the public record held about nine named families, proofs of concept included ^[5]. "It just wasn't what I was expecting," Fetterman told WIRED ^[6]. CAIRN then produced about 20 more examples across several months of development and use ^[7].

Those two numbers do not divide. Nine counts named families. Twenty counts examples collected through one tool, and Talos has not published enough detail to say how many of them are active threats, incomplete tools or experiments ^[8]. Reading 20 over nine, roughly 2.2, as growth would require resolving the 20 into families first, then showing each one operational ^[17].

Talos also warns that common application frameworks expose AI-related strings in files with no malicious AI capability. Clusters produce leads, and each significant finding still needs validation ^[12]. The adoption cost lands on analyst time in that queue; the corpus itself is SQLite and the import path is YARA ^[10].