Ankura CTIX FLASH Update – September 28, 2026

Malware Activity

ClosedQuorum Malware Lets AI Models Decide How to Attack Windows Systems

ClosedQuorum is a new Windows malware implant that delegates its post compromise decisions to a “panel” of commercial AI models (Google Gemini, DeepSeek, Qwen, and Mistral) instead of a traditional attacker run command and control (C2) server. The Go based malware sends basic host details (name, OS version, admin status) and a fixed menu of actions to the models: steal, inject, persist, or move (the public build has no code for move). Each model must respond in a strict format where the malware tallies the votes and executes the winning action. “Steal” simultaneously dumps LSASS credentials, grabs saved browser passwords (Chrome, Edge, Firefox), and extracts data from MetaMask, Exodus, and Ethereum wallets. “Inject” generates shellcode and uses Early Bird APC injection or process hollowing. “Persist” creates Registry Run entries, scheduled tasks, and WMI event subscriptions disguised as