Cisco TalosPublished
The Closed Quorum: Inside the first reported autonomous AI C2 implant
By Ryan Fetterman
Excerpt
Tuesday, September 22, 2026 06:00
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
This malware is a useful reference example of how attackers can collapse the decision space of a particular attack phase into a constrained set of choices, allowing AI models to pr…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Cisco Talos on blog.talosintelligence.com.
Mentioned in the excerpt
More from Cisco Talos7
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos · Published 16 Jul
- UAT-7810 continues building ORB networks using new malwareCisco Talos · Published 7 Jul
- New Dohdoor malware campaign targets education and health careCisco Talos · Published 26 Feb
- UAT-8302 and its box full of malwareCisco Talos · Published 5 May
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
