Affected Systems
Windows systems. ClosedQuorum is a Go-based malware that targets credentials from LSASS, browsers (Chrome, Edge, Firefox), and cryptocurrency wallets (MetaMask, Exodus, Ethereum). No specific Windows versions identified. No CVE assigned (campaign-based threat).
Exploitation Status
No confirmed in-the-wild deployment reported. Cisco Talos analyzed a sample with placeholder API credentials and dummy Discord webhook. Developer linked to criminal forums (carding) dating to 2025. Appears to be experimental or proof-of-concept at this stage.
Business Impact
ClosedQuorum represents a shift toward fully automated attack chains that operate without human operator interaction. The malware uses Google Gemini, DeepSeek, Qwen, and Mistral AI models in a voting system to autonomously decide whether to steal credentials, inject shellcode, or persist on compromised hosts. Stolen data exfiltrates via Discord webhooks. While not yet confirmed active, this architecture enables attacks to proceed at machine speed and scale beyond traditional C2 limitations. Defenders face challenges detecting autonomous decision-making that lacks typical C2 traffic patterns.
Urgency
🟡 Within a week
Recommended Actions
- Monitor for unusual API calls to Google Gemini, DeepSeek, Qwen, and Mistral services from endpoints, especially combined with credential access or process injection behavior
- Detect LSASS memory dumping, browser credential theft, and cryptocurrency wallet file access occurring simultaneously as ClosedQuorum executes its 'steal' decision
- Identify Discord webhook traffic from endpoints as potential exfiltration channel; block or alert on non-business Discord API usage
- Deploy Cisco Talos CAIRN toolkit to track and analyze AI-integrated malware behaviors in your environment
- Harden credential storage using Credential Guard on Windows 10/11 Enterprise and monitor for process hollowing and Early Bird APC injection techniques