Automated Threats: Analyzing the Evolution of LLM-Driven Malware
Cyber attackers are adapting rapidly with the integration of artificial intelligence, leveraging its capabilities to enhance the speed and scalability of their operations. Recent analysis by Cisco Talos highlights a significant leap in this trend with the emergence of an architecture dubbed CLOSEDQUORUM, which automates substantial portions of the cyber attack process without human intervention.
Identified by Cisco Talos, the CLOSEDQUORUM malware represents a novel approach referred to as “LLM-as-C2.” This refers to the use of large language models (LLMs) which formulate and execute strategies specifically aimed at credential theft, transforming traditional attack methods. “This isn’t just about augmenting human capability; it's about transferring an entire phase of the attack process to an automated system,” articulated Ryan Fetterman, a security and threat researcher at Cisco Talos, in a recent blog post detailing these findings.
This shift means that attackers can execute strategies around the clock, overcoming the limitations inherent in human operators, such as fatigue and varying attention spans. “An AI can continue its work while the attacker sleeps,” Fetterman pointed out, underscoring the potential for constant, unflagging operations. However, it’s essential to clarify that there’s currently no verifiable evidence that CLOSEDQUORUM has been deployed in actual cyber attacks.
An Autonomous Decision-Making Framework
The discovery of CLOSEDQUORUM was facilitated by Cisco Talos’s Cognitive Artifact Intelligence Research Network (CAIRN), an innovative research toolkit designed for tracking AI-integrated malware. This new malicious software streamlines decision-making within a particular attack phase by using LLMs to make constrained choices independently.
CLOSEDQUORUM particularly targets Microsoft’s Local Security Authority Subsystem Service (LSASS), which is responsible for credential management, and exploits it to extract sensitive logins and password data. Additionally, the malware is capable of stealing browser-saved passwords from Chrome, Edge, and Firefox, alongside targeting crypto wallets such as MetaMask and Ethereum.
The malware compiles its operation using Google's Go programming language, creating a 64-bit executable capable of supporting multiple LLM integrations, including DeepSeek, Qwen, Mistral, and Google Gemini. Upon deployment, it prompts the LLMs with commands to act as a competent malware strategist, receiving and processing instructions without requiring direct human oversight. Each model votes on what action should be taken, with the majority vote determining the course of action.
This design underscores how the dynamic operation of the malware is fully delegated to the AI. The system is structured so that it receives context and parameters, executes choices, and continues its operations autonomously. “The entire decision-making is confined to explicit JSON outputs that map directly to executable capabilities,” explained Fetterman, emphasizing the efficiency Gains achieved through this method.
In the event of conflicting judgments within the LLM panel, CLOSEDQUORUM has a predefined hierarchy to resolve disagreements, favoring DeepSeek first, followed by Qwen, Mistral, and then Gemini. This deterministic approach is designed to ensure functionality even when individual model responses are flawed or incomplete. If all models fail to reach a conclusion, the system halts and retries instead of immediately executing a default action, which adds an intriguing layer of self-regulation.
Fetterman classified CLOSEDQUORUM as a “credentials-as-a-service” framework, enabling attackers to initiate operations without being actively online. “The attacker deploys the malware and lets the LLM handle the rest,” he stated. This method has broad implications, suggesting that similar approaches could be employed to achieve varied malicious objectives.
A Critical Shift in Cyber Threats
The unveiling of CLOSEDQUORUM coincides with the release of the CAIRN toolkit, aimed at enhancing the capabilities of security professionals in combating AI-integrated threats. CAIRN takes a metadata-first approach, facilitating structured analyses that help identify relationships among different malware families and their operational frameworks.
Malware samples are processed via platforms like VirusTotal, which extract and catalog a vast array of metadata. CAIRN’s functionalities include tracking behaviors, identifying semantic correlations, and mapping the connections among campaigns, allowing defenders to stay ahead of burgeoning threats.
The researchers have noted a rapid evolution in autonomous frameworks since the onset of 2025, with a stark transition from models that merely augment operator capabilities to fully autonomous systems that require no human interaction. “We might be at a fleeting point in observing this transition,” Fetterman commented, noting the increasingly common integration of AI into software development.
CLOSEDQUORUM exhibits specific characteristics, such as inbound API communications linked to unexpected Windows executables, which signal potential malicious activities. The malware's ability to execute processes at randomized intervals and interact with platforms like Discord underscores the sophisticated nature of current attack vectors.
While this new malware technique offers remarkable advantages to attackers, it’s not without vulnerabilities. Potential weaknesses arise from model refusals, output errors, and strict dependency on external APIs, all of which could lead to operational failures and increased exposure risks.
Fetterman concluded by highlighting the imperative for defenders to capitalize on the early stages of this transition. “Autonomy in malware doesn't equate to infallibility; it merely shifts weaknesses from humans to algorithms,” he stated, pointing to both challenges and opportunities as the security landscape evolves.
