The malware that pays four AI providers to plan its attacks

On 22 September, Cisco Talos documented CLOSEDQUORUM↗, a Windows implant that hands the attacker's job to a committee of chatbots: up to four commercial AI models vote on its every move, no operator in the loop ¹. Security buyers now have to price a new line item: funding detection against an attack phase with no human bottleneck, one that keeps stealing whether or not anyone is watching. Research Cisco published the next day put a number on the gap, with 95% of enterprises saying their current AI operations tools cannot keep up ².

Four models vote, and DeepSeek breaks every tie

The 16.4MB Go binary polls DeepSeek, Qwen, Mistral and Gemini for its next move: inject, persist, steal or move. Plurality wins, and ties break to DeepSeek, then Qwen, Mistral, Gemini ¹. Its standing prompt: "You are an advanced malware strategist. Provide ONLY executable decisions." One steal vote runs LSASS dumping, Chrome, Edge and Firefox password theft, and MetaMask, Exodus and Ethereum wallet extraction in a single pass, then posts the AES-256-GCM encrypted haul to the operator's Discord webhook, re-deciding on a randomized 5 to 15 minute loop ¹³.

The command server is now a paid subscription

The blockable thing in an intrusion used to be the server: a domain to sinkhole, an IP for blocklists. CLOSEDQUORUM swaps it for the same four API endpoints legitimate software calls all day, so blocking the infrastructure breaks honest programs ¹. Each buyer's build compiles in its own API keys ¹, which makes every implant a paying customer of the providers it directs, billed per call. Nothing in the public record shows any of the four has flagged the traffic; Talos notes the offensive prompt language would likely be visible only through TLS inspection or provider-side telemetry ¹.

From writing commands to choosing the mission

The lineage is short. In July 2025, Ukraine's CERT-UA flagged LAMEHUG, an implant that fetched its commands from a model through a Hugging Face API; CLOSEDQUORUM goes further and asks the models to choose the mission ⁴. Talos researcher Ryan Fetterman counted only about nine named AI-integrated malware families in a summer retrospective↗; CAIRN, the toolkit Talos open-sourced with the disclosure, has surfaced about 20 more since ⁴. Static analysis of the binary dates to 17 June, three months before disclosure ¹.

The finder sells the cure, one day later

Cisco quantified the demand its researchers had named. An Omdia survey of 1,000 IT leaders↗ has 95% calling existing AIOps tools inadequate, 51% already running agentic AI in production, and 24% comfortable with agents acting under no human oversight ². Product chief Jeetu Patel says "Defences can no longer be human scale" ⁵. The double role is the point: the Talos unit that found CLOSEDQUORUM and the product arm selling the cure into the same fear are one company. The cure has a name: AgenticOps, agent-run network operations under human-set guardrails, sold alongside the AI-powered connect-and-protect platform 86% of buyers want as one integrated tool ².

Orders outran revenue, and the market noticed

The market voted early: the stock returned 62% over twelve months to 24 September against 16% for the S&P 500↗ ⁶. Cisco's fiscal 2026, company-claimed: $9.3 billion of AI infrastructure orders, about 4.5 times the prior year, against roughly $4 billion of AI revenue, and a $7.5 billion fiscal 2027 goal ⁶.

A product listing, not an outbreak

Talos has confirmed no victim, and the shipped build is inert: placeholder API keys, a dummy webhook ¹³. It is unclear whether the sample is a test or an experiment ³. Talos reads it instead as a credentials-as-a-service kit whose differentiator is the autonomous LLM layer ¹: a buyer who cannot code can rent an attack phase that keeps working while the attacker sleeps.

Detection moves from domains to behavior

The tells are behavioral now: one Windows process polling several AI providers while touching LSASS and posting to Discord ¹. The attack phase no longer waits for its operator, and the buyer's side of the ledger opens where the finder's own survey put it: 95% say current tools cannot keep up ². The first hard read on whether the cure pays arrives with Cisco's fiscal first-quarter report, the first check on the $7.5 billion AI-revenue goal ⁶.