Cisco Talos finds CLOSEDQUORUM, first 'LLM-as-C2' malware that automates the attack chain

ChuckDBrooks · x · 2026-09-24

Cisco Talos researchers identified what they call the first "LLM-as-C2" architecture: malware dubbed CLOSEDQUORUM queries multiple LLM judges, tallies their decisions, and automatically executes the winning action — fully automating the command-and-control chain for credential theft.
Researcher Ryan Fetterman: this doesn't just augment an operator, it "transfers an entire phase of the attack from the operator to the system."
Key implication: the human-in-the-loop bottleneck is gone — no working hours, attention limits, or sleep. "It does not go offline when the attacker sleeps."

More from Safety