🕵️ CLOSEDQUORUM

The items that name it 6

• Malware Analysis: Analyzing AI-Backed Malware with CAIRN
  writeup2026-10-07

  Windows implant documented by Cisco Talos as the first publicly documented implant to apply AI models to tactical command and control (C2); after deployment it calls up to four commercial LLM provider endpoints to collectively decide what to do next, executing those decisions to harvest user credent

• Check Point Research — 28th September Threat Intelligence Report
  article2026-09-28

  Windows malware that uses four commercial AI models to determine its next post-compromise action, able to direct credential and cryptocurrency wallet theft, persistence, or process injection. Not confirmed by Cisco Talos to have been deployed in real-world attacks.

• Trust and the enticing consultancy offer
  article2026-09-24

  Malware binary discovered through Talos' CAIRN project; first reported autonomous AI C2 implant that delegates selection of its next action to a panel of commercial LLMs and executes the resulting decision.

• The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
  writeup2026-09-22

  First reported autonomous AI C2 implant; Windows Go binary delegating tactical decisions to a panel of LLMs (DeepSeek, Qwen, Mistral, Gemini) for credential and crypto wallet theft; discovered via Cisco Talos' CAIRN project; developer linked to carding forum postings dating to 2025; renamed from BAL

• Introducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
  tool2026-09-22

  Named finding shared as CAIRN's initial release example of AI-integrated malware tracked via the toolkit

• CAIRN — Cisco Talos AI-Malware-Hunting Toolkit
  repo

  Go autonomous AI agent malware; archetype A4; described as 'the first reported autonomous AI C2 implant'; documented in docs/families/CLOSEDQUORUM.md