CLOSEDQUORUM Propose Change

According to Cisco Talos, CLOSEDQUORUM is a 64-bit Windows implant written in Go that delegates its command and control to a panel of up to four commercial large language model providers instead of an attacker-operated server. Each model receives collected host context and has to answer in a constrained JSON decision schema, after which the implant executes the action with the most votes, breaking ties in a fixed provider order. The available actions are credential theft from LSASS memory, browser password stores and cryptocurrency wallets, shellcode execution via Early Bird APC injection or process hollowing, and persistence via a Run key, a scheduled task or a WMI event subscription. Collected data is encrypted with AES-256-GCM using a date-derived key and sent to an operator-controlled Discord webhook, while ETW patching, a delayed start and randomized polling intervals are used to evade sandboxes.

References

There is no Yara-Signature yet.