CLOSEDQUORUM — Autonomous AI-Orchestrated C2 Implant

CLOSEDQUORUM is a 16.4MB, 64-bit Windows implant written in Go (CGO-enabled) that Cisco Talos disclosed on 2026-09-22 through its new CAIRN research toolkit. Its distinguishing feature is architectural, not technical: instead of phoning home to attacker-run C2 infrastructure, it queries up to four commercial LLM providers (DeepSeek, Qwen via OpenRouter, Mistral, and Google Gemini) with structured host-context prompts, tallies their independent votes by plurality, and autonomously executes whichever of four actions wins — steal (LSASS dump + browser credential theft + crypto wallet extraction, all three simultaneously), inject (Early Bird APC injection by default, process hollowing if the model selects it), persist (Registry Run key + scheduled task + WMI event subscription, all three), or move (defined in the decision schema but not implemented in the distribution build). Ties are broken in a fixed order: DeepSeek, then Qwen, then Mistral, then Gemini. The attacker never issues commands once the implant is running — the LLM panel does.

Read this before anything else in this pack. Cisco Talos explicitly states it has not confirmed in-the-wild deployment. The publicly analyzed distribution binary ships with placeholder API keys (dummy_api_key) and a non-functional Discord webhook (dummy_webhook_url) — it cannot reach any LLM provider or exfiltrate anything as distributed. Talos observed the full architecture only through static analysis of development builds; it did not observe a complete end-to-end live execution. The six SHA256 hashes in this pack are development build hashes from the malware's own build chain, not samples recovered from a victim environment. Everything in this pack should be treated as hunting for a credible, technically-confirmed but not-yet-observed-active threat model — not as an active campaign. The one piece of real-world attribution Talos offers is that artifacts in the binary tie the developer to carding-forum posts dating back to 2025, consistent with an operator-configured credentials-as-a-service offering rather than a deployed campaign.

The attacker's objective, per Talos, is straightforward credential and cryptocurrency theft — there is nothing novel about what CLOSEDQUORUM steals. What is novel is effort displacement: an entire post-compromise decision phase (which action to take next, against which process, with which technique) is delegated from a human operator to a model panel that keeps running whether or not the attacker is at a keyboard. Traditional C2 requires attacker-run infrastructure — a domain, an IP, a listener — that defenders can track, block, and see rotate. CLOSEDQUORUM instead rides four commercial API endpoints that thousands of legitimate applications call every day, plus a Discord webhook, which is exactly why Talos and every outlet that covered this story land on the same recommendation: this is a behavioral-correlation hunt, not a domain-blocking exercise. DeepSeek, OpenRouter, Mistral, and Gemini API traffic is not inherently suspicious and must never be treated as a block candidate on this intelligence alone.

Highest-value defensive angle: no single indicator in this threat model is reliable in isolation. The combination is what's distinct — one non-browser process reaching two or more LLM provider APIs, correlated on the same host or same process with LSASS access, suspended-process injection precursors, a "WindowsUpdate" Run-key write, scheduled-task creation, the C:\Windows\Temp\wmi.ps1 forensic artifact, or Discord webhook egress. Section 8, Q7 builds that correlation directly; every other query in this pack is a component signal meant to feed it.

Four sources were fetched and saved verbatim to this pack's source-snapshot directory (CLOSEDQUORUM-AI-C2-Implant-Hunt-sources/) before any indicator or technical claim in this pack was written. No fetched content contained instructions directed at an AI agent, requests to change output behavior, or any other prompt-injection attempt — all four sources are plain threat-intelligence reporting.

Decisions: All four sources trace back to the same underlying Talos technical analysis — they are corroborating summaries of one primary disclosure, not independent confirmations from separate research. This pack treats the intelligence as single-primary-source accordingly: no indicator in this pack is recommended for action=prevent/blocking on that basis (see Section 10). No delivery vector was reported by any source — Talos found CLOSEDQUORUM through static/behavioral analysis via CAIRN, not through incident response, so how it would reach a victim endpoint is unknown and out of scope for this pack.

Hunt hypotheses

Attack chain

All six SHA256 hashes are development-build hashes from the malware's own build chain, published by Talos as static-analysis artifacts — not samples recovered from a compromised environment. They are shipped here at action=hunt (search and manually evaluate), never action=prevent/detect-block, because this pack has one primary technical source and single-sourced indicators do not ship as blocking recommendations in this library.

These checks cover ground the CQL queries in Section 8 cannot reach with the Falcon data model referenced by this pack — either because the telemetry isn't exposed as a queryable field, or because the technique targets the telemetry pipeline itself. Run them as Falcon Real Time Response (RTR) scripts, scheduled PowerShell via GPO/RMM, or native Windows tooling, not as CQL.

1. On-disk LSASS dump / staging artifact sweep (RTR)

CLOSEDQUORUM stages LSASS dumps, browser databases, and wallet files under C:\Windows\Temp\ before transmission. Falcon's referenced data model has no dedicated event for arbitrary non-PE file writes, so this is a point-in-time filesystem sweep rather than a continuous query:

Get-ChildItem -Path 'C:\Windows\Temp\' -File -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.dmp','.tmp' -or $_.Name -match '^(lsass|wallet|login|creds?)' } |
  Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc

Caveat: a positive hit only means a suspicious file existed at scan time — the implant does not persist these files (they are staged for transmission, then presumably cleaned up), so absence of a hit on a scheduled sweep does not clear a host. Treat this as a secondary corroboration check, not a primary detection.

2. WMI permanent event subscription audit (RTR / scheduled PowerShell)

Falcon's referenced event model does not expose WMI __EventFilter / __EventConsumer / __FilterToConsumerBinding objects as first-class CQL fields, so the persistence mechanism itself (not just its wmi.ps1 side effect, covered by Q4) needs a native query:

Get-CimInstance -Namespace root\subscription -ClassName __EventFilter |
  Where-Object { $_.Name -match 'Windows ?Update' -or $_.Query -match 'Win32_PerfFormattedData' } |
  Select-Object Name, Query
Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer |
  Where-Object { $_.Name -match 'Windows ?Update' } |
  Select-Object Name, CommandLineTemplate
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding

Also enable and forward the Microsoft-Windows-WMI-Activity/Operational event log (disabled by default on many builds) — it is the durable, native audit trail for WMI subscription creation and is not dependent on the Falcon sensor's own event model.

3. ETW tamper detection (compensating control, not a query)

CLOSEDQUORUM suppresses ETW by overwriting EtwEventWrite in its own process's memory with a single RET instruction. This is a self-blinding technique: the telemetry pipeline used to observe the tampered process may itself go dark for that process at the moment of tampering. No CQL query against post-hoc log data can reliably catch the instant of patching. Compensating controls, not queries: (a) rely on your EDR vendor's kernel-mode sensor components and anti-tamper protections, which are not solely dependent on user-mode ETW providers — validate this claim with your specific vendor rather than assuming it; (b) enable Protected Process Light (PPL) / HVCI where your EDR supports registering as a protected process, which raises the bar for a user-mode implant to patch the sensor's own hooks; (c) treat any host where CLOSEDQUORUM's OTHER behavioral signals (Section 8) go silent mid-session, after having fired once, as higher priority for manual triage — a telemetry gap immediately following a partial hit is itself a signal.

4. TLS-inspected proxy log review for LLM-prompt content and Discord webhook payloads

Both Talos and The Hacker News note that the structured prompts (host context, offensive capability language) and the Discord webhook payload content are visible only through TLS inspection or provider-side telemetry, not through Falcon network metadata alone. Talos's Snort rule 1:66984 matches on the implant's prompts to the AI services and requires TLS inspection to fire. If your environment performs TLS interception, review proxy logs for: (a) POST bodies to the four LLM provider API endpoints containing structured JSON with fields resembling target_process, exploit_type, evasion_method, or payload_config; (b) POST bodies to discord.com/api/webhooks/... containing Base64 code blocks in ~1,900-byte segments at roughly 1-second intervals.

Four queries are strong Custom IOA candidates — high confidence, low-to-medium FP, and each is a distinctive behavioral pattern rather than a broad recon sweep. The rest remain investigate-only hunt queries (build baselines, corroborate hits, or accept a documented high-FP rate) until your environment's own FP data justifies promotion.

IOA candidates

Q7 (the composite correlation) is the highest-fidelity detection in this pack but is intentionally kept as a scheduled hunt query rather than a real-time IOA in this initial version: selfJoinFilter correlation queries carry meaningfully higher COST, and this pack has not yet been validated against a live tenant's query-cost budget for real-time execution. Re-evaluate for IOA promotion after the validation gates in Section 11 are cleared in your environment.

Read before importing anything below. This pack has one primary technical source (Cisco Talos). Per this library's standing rule, no indicator sourced from a single report ships at action=prevent/block. The six hashes below are development-build artifacts, not victim-environment samples, and ship at action=hunt only. The commercial LLM provider API domains (DeepSeek, OpenRouter, Mistral, Gemini) are legitimate infrastructure used by thousands of applications and must never be imported as block candidates — they appear below only as correlation signals for the CQL queries in Section 8, clearly labeled as such.

type,value,action,severity,expiration,description,tags
sha256,250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source
sha256,c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source
sha256,c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source
sha256,f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source
sha256,5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source
sha256,eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5,hunt,medium,2026-12-24,CLOSEDQUORUM development-build hash (Talos CAIRN static analysis) -- NOT a confirmed victim-environment sample,campaign:CLOSEDQUORUM;status:dev-build;confidence:single-primary-source

# Registry Run-key value (see Q2, Q7)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run  ->  value name: WindowsUpdate

# WMI persistence forensic artifact (see Q4)
C:\Windows\Temp\wmi.ps1

# Process-tree pattern for WMI-triggered execution
wmiprvse.exe (or WMI event consumer)  ->  powershell.exe  ->  CommandLine contains "wmi.ps1"

# Non-browser process resolving 2+ of these in one session -- CORRELATION SIGNAL ONLY, DO NOT BLOCK (see Q1, Q7, Q8)
api.deepseek.com
openrouter.ai
api.mistral.ai
generativelanguage.googleapis.com (Google Gemini API)

# Reporting / exfil channel -- CORRELATION SIGNAL ONLY, DO NOT BLOCK WHOLESALE (see Q5)
discord.com
discordapp.com
cdn.discordapp.com

Family: CLOSEDQUORUM
Prior internal name (per Talos): BALZAK (renamed 2026-07-03)
Discovery toolkit: CAIRN (Cisco Talos, open-source, released 2026-09-22)
YARA rule: CLOSEDQUORUM_LLM_Autonomous_Implant (author: CAIRN, tier: T3, confidence: high)
Snort rule: 1:66984 (requires TLS inspection to match implant prompts to LLM providers)
Related prior art (cited by Talos/press, NOT this campaign): LAMEHUG (CERT-UA, July 2025) -- asked an AI model
  to WRITE commands; CLOSEDQUORUM asks the model to CHOOSE the action. Different technique, do not conflate.

# This is a novel implant architecture, not a vulnerability -- there is no patch or ASR
# signature CVE to audit against. Use this checklist instead:
[ ] Confirm LSA Protection (RunAsPPL) is enabled fleet-wide (Section 12/13, Immediate)
[ ] Confirm ASR rule "Block credential stealing from lsass.exe" (GUID
    9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) is deployed in Block mode, not Audit
[ ] Confirm AppLocker/WDAC blocks execution from %TEMP% and %APPDATA% for non-approved binaries
[ ] Confirm Microsoft-Windows-WMI-Activity/Operational and TaskScheduler/Operational logs are
    enabled and forwarded
[ ] Run Q8 (baseline) for 14 days before promoting Q1 to an alerting IOA
[ ] Confirm your EDR/proxy stack has NOT been configured to block api.deepseek.com / openrouter.ai /
    api.mistral.ai / the Gemini API outright -- these are correlation signals, not block targets

See Section 15 (Detection Coverage Map) for the honest gaps — LSASS access, process injection, and ETW tampering — that no amount of query tuning closes with the telemetry referenced in this pack.

Platform scope

CLOSEDQUORUM is a Windows-only implant (64-bit Go/CGO executable targeting Win32 APIs). All hardening below is Windows/AD-focused; no Linux, macOS, cloud, or container surface is touched by this threat.

Playbook 1 — Enable LSA Protection (RunAsPPL)

Blocks non-PPL processes (including an unsigned Go implant) from opening the handle to lsass.exe that MiniDumpWriteDump requires. Directly stops CLOSEDQUORUM's steal/lsassDump() capability.

Step 1 -- Set the registry value (deploy via GPO Preferences or your RMM, not manually per-host):
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

Prerequisites: Windows 8.1/Server 2012 R2 or later. Inventory any third-party LSA plugins/credential
  providers (some smartcard middleware, legacy VPN clients, and older AV credential providers are NOT PPL-
  compatible and will fail to load) BEFORE fleet-wide rollout; pilot on a representative ring first.
Reboot required: YES -- LSASS re-reads this value only at boot.
Rollback: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 0 /f
  then reboot. If a host becomes unbootable due to an incompatible LSA plugin, boot into Safe Mode or WinRE
  and delete/zero the RunAsPPL value via offline registry edit, then reboot normally.

Playbook 2 — Deploy the LSASS-credential-theft ASR rule

Microsoft Defender's Attack Surface Reduction rule for LSASS credential theft blocks common credential-dumping techniques (including MiniDumpWriteDump-style access from non-allow-listed processes) at the OS level, independent of RunAsPPL.

Step 1 -- Audit first (always -- ASR rules can break legitimate LSASS-adjacent tooling):
  Set-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 `
    -AttackSurfaceReductionRules_Actions AuditMode

Step 2 -- Review Defender ASR audit events (Event ID 1122, Microsoft-Windows-Windows Defender/Operational)
  for 1-2 weeks; identify and allow-list any legitimate tooling that triggers (some backup/EDR/diagnostic
  tools legitimately touch LSASS).

Step 3 -- Move to Block mode once the audit period is clean:
  Set-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 `
    -AttackSurfaceReductionRules_Actions Enabled

Prerequisites: Microsoft Defender Antivirus must be the active AV engine (ASR rules do not function in
  passive/EDR-only mode on some configurations -- verify with Get-MpComputerStatus). Requires E5/Defender for
  Endpoint Plan 1+ licensing for centralized reporting (the rule itself works without it).
Reboot required: NO.
Rollback: Set-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 `
  -AttackSurfaceReductionRules_Actions Disabled

Playbook 3 — AppLocker path rule blocking execution from %TEMP% / %APPDATA%

Targets the implant's own launch path and the wmi.ps1 drop location under C:\Windows\Temp\ specifically.

Step 1 -- Build and test in Audit mode first (New-AppLockerPolicy / Set-AppLockerPolicy):
  $rule = New-AppLockerPolicy -RuleType Path -User Everyone -RuleNamesToGenerate `
    -PathConditions "%OSDRIVE%\Users\*\AppData\Local\Temp\*","%OSDRIVE%\Windows\Temp\*" -Deny
  Set-AppLockerPolicy -PolicyObject $rule -Merge

Step 2 -- Deploy via GPO in Audit-only enforcement mode for 2-4 weeks; review
  Microsoft-Windows-AppLocker/EXE and DLL + Microsoft-Windows-AppLocker/MSI and Script logs for legitimate
  software that launches from Temp/AppData (many installers do -- expect a real allow-list burden here).

Step 3 -- Add allow-list exceptions for confirmed-legitimate installers/updaters, then switch enforcement
  from Audit to Enforce.

Prerequisites: Windows 10/11 Enterprise or Education edition (AppLocker enforcement requires these SKUs;
  Pro/Home cannot enforce, only audit via limited functionality). Application Identity service must be running.
  WDAC is the modern equivalent if you are not on Enterprise/Education licensing.
Reboot required: NO (policy applies at next Group Policy refresh / gpupdate /force).
Rollback: remove the GPO link, or set the rule collection back to "Not Configured" and run gpupdate /force.
  No reboot needed to roll back.

Playbook 4 — Disable browser saved-password storage (Chrome/Edge policy)

Step 1 -- GPO / registry (Chrome, via ADMX or direct registry under HKLM\SOFTWARE\Policies\Google\Chrome):
  reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

Step 2 -- Edge (HKLM\SOFTWARE\Policies\Microsoft\Edge):
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

Prerequisites: an approved enterprise password manager must already be deployed and communicated to users
  BEFORE this rolls out, or you will generate a support-ticket spike and users will route around the policy
  with personal browser profiles.
Reboot required: NO -- takes effect on next browser policy refresh / browser restart.
Rollback: set PasswordManagerEnabled back to 1 (or remove the registry value) and restart the browser.

Honest summary: this pack has strong coverage of CLOSEDQUORUM's network-correlation and persistence behaviors (T1102, T1547.001, T1546.003's side effect, T1567.004) because those all produce telemetry Falcon's documented CQL data model exposes cleanly. It has real, acknowledged gaps on the credential-theft and injection techniques (T1003.001, T1055.004/.012) and on the evasion techniques (T1685, T1480.001/T1497.003) because those either aren't exposed as queryable fields in the referenced data model or are specifically designed to blind the telemetry pipeline that would observe them. Do not represent this pack as full-kill-chain coverage in any downstream reporting — it is strong on correlation and persistence, partial on credential theft, and gapped on injection and evasion. Section 7's native/RTR checks and Section 12/13's hardening controls (LSA Protection, the LSASS ASR rule) are the compensating controls for the gapped techniques, not a query.

Source text for all four cited news/research sources was fetched and saved verbatim to CLOSEDQUORUM-AI-C2-Implant-Hunt-sources/ before this pack was written, so every atomic indicator above traces to a specific saved snapshot rather than to memory or summary.