22-09-2026
The Closed Quorum: Inside the first reported autonomous AI C2 implant
https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/
Report completeness: High
Threats:
Closedquorum
Apc_injection_technique
Process_injection_technique
Lsass_dumper_tool
Victims:
User credentials, Crypto wallets
TTPs:
Tactics: 9
Technics: 1
IOCs:
File: 12
Path: 2
Hash: 6
Soft:
DeepSeek, Qwen, Mistral, Discord, Chrome, Firefox
Wallets:
metamask, exodus_wallet
Crypto:
ethereum
Algorithms:
aes-256-gcm, base64, sha256
Functions:
CLOSEDQUORUM, interModelDiscussion, lsassDump, dumpBrowserCredentials, extractCryptoWallets, generateShellcode, injectProcess, earlyBirdInject, establishPersistence, gatherSystemInfo, have more...
Win API:
arc, NtQueueApcThread, MiniDumpWriteDump, SeDebugPrivilege, EtwEventWrite
YARA: Found
Links:
https://github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network