New ClosedQuorum Windows malware uses AI for attack decisions
-
A newly discovered Windows malware family called ClosedQuorum is notable for using large language models to make its own operational decisions after a system has been compromised. According to the research, the malware queries Google Gemini, DeepSeek, Qwen, and Mistral AI to autonomously determine which actions to take during post-compromise stages of an attack. This marks a shift from static, pre-programmed malware behavior toward AI-driven decision-making, where the model itself helps select the next step rather than following a fixed set of instructions.
Key points from the reporting:
- ClosedQuorum targets Windows systems.
- It leverages multiple AI models, specifically Google Gemini, DeepSeek, Qwen, and Mistral AI.
- The AI is used for autonomous decision-making during post-compromise activity, not merely for generating text or phishing lures.
- The exact technical details of the command-and-control flow and the specific prompts used were not fully detailed in the source.
At this stage, no specific CVE identifier has been published in connection with this malware, and no KB numbers or advisory IDs were provided. Defenders should treat this as an emerging threat class rather than a patchable software flaw. Because the malware relies on external AI model APIs, network monitoring for unusual outbound requests to AI service endpoints may help surface related activity.
Source: BleepingComputer
How is your organization approaching the risk of malware that calls out to public AI models to drive its own decisions?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login