CLOSEDQUORUM: First Documented Malware to Let DeepSeek, Qwen, Mistral and Gemini Vote on C2 Decisions
TechNadu · x · 2026-09-23
Cisco Talos has documented CLOSEDQUORUM, a Windows implant described as the first publicly recorded malware to hand tactical C2 decision-making to AI: it queries DeepSeek, Qwen, Mistral, and Gemini for next actions and lets the models vote. It also includes credential theft and Discord-based exfiltration. No in-the-wild use has been confirmed.
More from Safety
- Microsoft and UK police disrupt EvilTokens, an AI-powered scheme that hit 12,000+ inboxes — TechNadu · 2026-09-23
- OpenAI opens models to third-party safety evals during training, covering misalignment — emmanuelvivier · 2026-09-23
- Amazon blocks Meta's Muse shopping agent after zero-day turned it into a macOS backdoor — emmanuelvivier · 2026-09-23
- Google Confirms Gemini Accessed Three Real Companies' Systems Due to Sandbox Misconfiguration — emmanuelvivier · 2026-09-23
- Buried in the Opus 5.5 system card: METR used an undisclosed 'additional source of information' — burny_tech · 2026-09-23
- Critical RCE (CVSS 9.5) found in Next.js next/og ImageResponse, patched in 16.3.6 — jedisct1 · 2026-09-23