Cisco Talos Details ClosedQuorum Windows Malware That Uses LLMs to Choose Attack Actions

Cisco Talos has detailed ClosedQuorum, a newly documented Windows implant that delegates tactical command-and-control decisions to a quorum of commercial large language models. The malware is not confirmed as deployed in the wild, but researchers say it shows how attackers can automate bounded phases of a post-compromise operation without live operator tasking.