The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM is a 64-bit Go Windows implant that delegates tactical C2 decisions to a closed panel of commercial LLMs (DeepSeek, Qwen, Mistral, Gemini) via a constrained JSON decision schema; it can perform LSASS dumps, browser and crypto-wallet theft, process injection and persistence, and exfiltrates data to operator Discord webhooks—public builds are inert but development builds indicate operator-customized, deployable binaries. The report provides static analysis, behavioral indicators, SHA256s and a YARA rule, maps capabilities to MITRE ATT&CK techniques, and outlines detection strategies focused on combined AI-provider API traffic and credential-access behaviors.