CLOSEDQUORUM: First Documented Malware to Let DeepSeek, Qwen, Mistral and Gemini Vote on C2 Decisions
TechNadu · x · 2026-09-23
Cisco Talos has documented CLOSEDQUORUM, a Windows implant described as the first publicly recorded malware to hand tactical C2 decision-making to AI: it queries DeepSeek, Qwen, Mistral, and Gemini for next actions and lets the models vote. It also includes credential theft and Discord-based exfiltration. No in-the-wild use has been confirmed.
More from Safety
- US data vendors accused of selling RL environments to Chinese military-linked firms — xeophon · 2026-11-11
- LMArena co-founder explains AI evaluation methodology and policy in new podcast — MattPerault · 2026-11-11
- Defending METR: public data can't second-guess its AI speedup findings — peterwildeford · 2026-11-11
- Australia's review of an OpenAI agent's unauthorized Medicare access exposes the agent accountability problem — cmb24k · 2026-11-11
- Adversarial RL envs for backdoor insertion vs. detection: where does it converge? — DimitrisPapail · 2026-11-11
- Using a third-party inference provider with your coding harness hands it shell access to your machine — TheZachMueller · 2026-11-11