Build1 publisher3 min readPublished
Talos finds a Windows implant that puts each attack step to a four-LLM vote
Cisco Talos read CLOSEDQUORUM statically: a Go binary that polls DeepSeek, Qwen, Mistral and Gemini before it touches LSASS. The distributed sample has dummy keys. One answering provider can carry the vote.
The Engineer · Build desk
What happened
- Cisco Talos statically analysed CLOSEDQUORUM, a Go-based Windows implant that sends host information to as many as four commercial LLMs and executes whichever attack action collects the most votes.
- The selectable actions include dumping credentials from LSASS memory, collecting browser credentials and cryptocurrency wallet files, Early Bird APC or process-hollowing injection, and persistence via Run keys, scheduled tasks or WMI.
- Votes are tallied from a Decision field in each JSON response, and ties break deterministically in provider order, starting with DeepSeek and ending with Gemini.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Blocking model-provider domains outright collides with the agent traffic a company now generates itself. So Talos writes its mitigation per endpoint or per process.
- capability Moving tactical selection to four provider accounts and a webhook leaves no attacker-run server to seize, so disruption means getting keys suspended at the vendors.
- decision Application control on unknown executables acts before any provider is polled, so defenders who cannot police outbound AI traffic per process are pushed back onto binary allowlisting.
- contradiction Talos rates the severity high for a sample it read but never observed running, so how much weight the report carries depends on whether a configured private build exists.
Each model picks from a list the author compiled. Talos says the implant sends the host information together with the selectable attack actions, and the returned decision executes only when it maps to an implemented capability handler [4][9]. LSASS dumping, browser credential and wallet collection, Early Bird APC, process hollowing and three persistence paths are compiled in already [7]. The vote chooses an index; the code is on disk before the first request goes out.
Plurality voting across four providers sounds like it needs at least three answers to function, but the operating precondition Talos lists is one valid JSON decision matching the predefined schema [9]. The failure modes it lists are refusals, rate limits, timeouts and malformed JSON [10]. Lose three voters to any of those and the survivor's single vote is the highest count, so the decision falls to whichever provider happened to answer [1].
Ties resolve deterministically in provider order, DeepSeek first, then Qwen, Mistral and Gemini [6]. With four voters a two-two split goes to the action DeepSeek chose whenever DeepSeek picked one of the tied pair, and a one-one-one-one split goes to DeepSeek outright [2][3].
Exfiltration runs on a fixed clock. Collected data is encrypted with AES-256-GCM, Base64-encoded, split into 1,900-byte segments and posted to a Discord webhook at one-second intervals [8]. Base64 turns three bytes into four, so each segment carries about 1,425 bytes of ciphertext, a little under 1.4 KB per second [4]. A megabyte of browser credentials and wallet files needs roughly 12 minutes of uninterrupted posting [5]. Talos lists recurring intervals of 5 to 15 minutes among the clues defenders should look for [14].
Destination is only one item on that clue list. It names an unknown Go executable communicating with multiple AI APIs and a Discord webhook, access to LSASS, browser data and wallets, process injection, and persistence entries that resemble Windows Update [14]. The mitigation is scoped the same way: restrict outbound communication to AI APIs and Discord webhooks that are unnecessary for business, on a per-endpoint or per-process basis [15]. Per process is the expensive half. An organisation whose own build agents call Gemini and Mistral all day cannot treat the endpoint as the signal, and has to attribute the socket to a binary first.
The binary Talos read is a template. Its API keys and webhooks are dummies, it does not work as distributed, and Talos has not confirmed execution in a real environment or published an initial access method [11][13]. Whether a configured private build has been deployed is unknown [12]. Talos graded the severity high anyway [16], and for a design whose only fixed operator infrastructure is four API keys and a webhook URL [19], I would grade it the same.
What to watch
- Confirmation that a configured private build ran on a real endpoint. Talos says that is the one thing it has not seen.
- Whether DeepSeek, Qwen, Mistral or Gemini start refusing these structured requests, since refusals and rate limits are already listed as the implant's failure modes.
- Whether endpoint tooling ships per-process attribution for outbound model-API traffic. Talos's mitigation assumes that granularity.