ClosedQuorum Malware: Detecting and Containing AI-Driven Windows Attacks That Use Gemini, DeepSeek, Qwen, and Mistral for Post-Compromise Decisions

A newly identified Windows malware family tracked as ClosedQuorum represents a meaningful shift in post-compromise tradecraft: instead of shipping with hardcoded logic or waiting on a human operator behind a C2 panel, it queries public large language models — Google Gemini, DeepSeek, Qwen, and Mistral — to autonomously decide what to do next on an infected host. Reconnaissance output is fed into prompts, the model returns an action plan, and the malware executes it.

Why this matters to defenders: the classic C2 model we have spent a decade tuning detections around is being hollowed out. Traffic to *.googleapis.com or api.deepseek.com over HTTPS looks, at the packet layer, like legitimate developer or AI-assistant activity. There is no shady VPS, no Cobalt Strike Malleable C2 profile, no DGA domain. The "operator" is a commercial LLM endpoint with a valid certificate and a reputable ASN. If your detection strategy is anchored on known-bad infrastructure, ClosedQuorum is engineered to sail straight through it.

The good news: this architecture introduces new, high-fidelity observables that most enterprise environments can exploit immediately. This post breaks down the attack chain, gives you production-ready Sigma, KQL, and VQL detections, and walks through containment and remediation.

Technical Analysis

What ClosedQuorum Is

ClosedQuorum is Windows-targeting malware whose distinguishing feature is an LLM-driven decision engine for the post-compromise phase. Rather than embedding a fixed playbook, it collects host telemetry, packages it into prompts, and asks one or more commercial AI models — Gemini, DeepSeek, Qwen, and Mistral are confirmed — to determine next actions. The model's response is parsed and executed on the host: discovery commands, credential access, persistence, lateral movement staging, or data collection, depending on what the model recommends given the environment it sees.

Attack Chain (Defender's View)

1. Initial access & staging — The malware lands through conventional means (phishing, loader, or dropped by another stage). The AI component activates after a foothold exists; this is a post-compromise capability, not an exploit.
2. Reconnaissance collection — The implant runs host discovery: OS version, domain membership, installed software, running processes, network configuration, user context, AV/EDR presence. Expect bursts of systeminfo, whoami /all, ipconfig /all, net / nltest, tasklist, and WMI queries originating from a non-standard parent process.
3. Prompt construction & LLM query — Collected output is serialized into prompts and sent over HTTPS to public LLM API endpoints. Observable targets include generativelanguage.googleapis.com (Gemini), api.deepseek.com, Qwen/DashScope endpoints (dashscope.aliyuncs.com), and api.mistral.ai. Calls typically require an embedded API key — meaning stolen or purchased LLM API keys are now part of attacker infrastructure.
4. Action execution — The returned plan is parsed and executed: shell commands, file staging, persistence writes, or further tooling. Command content may vary host-to-host because the model tailors it — degrading static IOC matching and YARA signatures for the "decision" layer.
5. Iteration — The loop repeats. The malware effectively gets an adaptive operator that reasons about each environment it lands in.

Why This Evades Traditional Detection

• C2 reputation feeds are blind: egress goes to Google, Alibaba, DeepSeek, and Mistral infrastructure — allowlisted in most egress policies and firewalls by default.
• No beaconing signature: request timing and volume resemble application API calls, not heartbeat beacons.
• Polymorphic behavior: because the LLM generates per-host action plans, command-line IOCs differ between victims. Signature-based detection on the payload of the decision fails; detection must anchor on the mechanics — who is talking to LLM APIs, and what is feeding them.
• Attribution friction: multiple unrelated actors can rent the same models, muddying clustering and campaign tracking.

Exploitation Status

ClosedQuorum is a confirmed in-the-wild malware family, not a proof-of-concept. No CVE is associated with this threat — it relies on legitimate LLM APIs by design, which is precisely why egress and behavioral controls matter more than patching. No CISA KEV entry applies. The defensive posture required is detection engineering plus egress control, not emergency patching.

Detection & Response

Detection Strategy: Where the Signal Lives

Three telemetry planes give you reliable coverage:

1. Egress to LLM API endpoints from non-browser, non-IDE processes. On servers and standard user workstations, there is rarely a legitimate reason for rundll32.exe, regsvr32.exe, an unsigned binary in %APPDATA%, or a random service to hold HTTPS sessions with Gemini, DeepSeek, Qwen, or Mistral. This is your highest-fidelity signal.
2. Reconnaissance bursts from anomalous parents. ClosedQuorum must interrogate the host before it can ask the model anything. A process outside the normal admin/scripting population running 4+ discovery commands in short succession is worth a look.
3. Command lines and scripts referencing LLM API endpoints or API key material (e.g., Authorization: Bearer headers, x-goog-api-key, api_key= parameters passed via curl or PowerShell).

A caution from the field: do not simply alert on any connection to an LLM domain. AI coding assistants, Copilot-style tooling, and vendor integrations have made LLM egress semi-normal in dev environments. Scope your rules to process context — that is what keeps these rules enabled past week one.

Sigma Rules

---
title: Non-Browser Process Network Connection to Public LLM API Endpoints
id: 3f7c2a91-8e44-4b1a-9c6d-2a5f8e1b7d04
status: experimental
description: Detects non-browser, non-development processes establishing HTTPS connections to public LLM API endpoints (Gemini, DeepSeek, Qwen/DashScope, Mistral). Consistent with AI-driven malware such as ClosedQuorum that queries LLMs for post-compromise decision-making.
references:
  - https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection_llm:
    DestinationHostname|contains:
      - 'generativelanguage.googleapis.com'
      - 'api.deepseek.com'
      - 'dashscope.aliyuncs.com'
      - 'api.mistral.ai'
      - 'open.bigmodel.cn'
  filter_browsers:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  filter_known_dev:
    Image|endswith:
      - '\Code.exe'
      - '\cursor.exe'
      - '\python.exe'
      - '\node.exe'
  condition: selection_llm and not 1 of filter_*
falsepositives:
  - Legitimate AI assistant or IDE plugin traffic; build an allowlist of sanctioned AI tooling processes per environment
  - Enterprise AI integrations running under service accounts
level: high
---
title: Command Line Reference to LLM API Endpoint or API Key Pattern
id: 8b1d4e62-5c39-4a7f-b2e8-9d3c6f0a1e57
status: experimental
description: Detects command-line invocations (curl, wget, PowerShell web cmdlets) referencing public LLM API endpoints or common LLM API key header patterns. ClosedQuorum-style malware frequently shells out or uses embedded HTTP clients with visible API key material.
references:
  - https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_endpoint:
    CommandLine|contains:
      - 'generativelanguage.googleapis.com'
      - 'api.deepseek.com'
      - 'dashscope.aliyuncs.com'
      - 'api.mistral.ai'
      - 'x-goog-api-key'
  selection_tool:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection_endpoint and selection_tool
falsepositives:
  - Developers testing LLM integrations from the command line; restrict deployment to server OUs and non-developer workstations, or allowlist developer groups
level: high
---
title: Discovery Command Burst From Suspicious Parent Process
id: 5e9a3f78-2d64-4c8b-a1f5-7b8e2d9c4a36
status: experimental
description: Detects host discovery utilities spawned by processes outside the standard interactive/admin population. AI-decision malware such as ClosedQuorum must profile the host (systeminfo, whoami, ipconfig, net, nltest, tasklist) before constructing prompts for the LLM.
references:
  - https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1082
  - attack.t1057
logsource:
  category: process_creation
  product: windows
detection:
  selection_recon:
    Image|endswith:
      - '\systeminfo.exe'
      - '\whoami.exe'
      - '\ipconfig.exe'
      - '\nltest.exe'
      - '\tasklist.exe'
      - '\quser.exe'
      - '\qwinsta.exe'
  filter_admin_shells:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mmc.exe'
      - '\sihost.exe'
  condition: selection_recon and not 1 of filter_admin_shells
falsepositives:
  - Login scripts, SCCM/MECM inventory, monitoring agents (Nagios, Zabbix, Datadog); baseline and allowlist known management tooling parent processes
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for non-browser processes communicating with public LLM API endpoints, enriched with the process lineage so analysts can pivot immediately. Deploy it in Defender Advanced Hunting or against DeviceNetworkEvents in Sentinel; the Syslog/CEF variant works if your network telemetry comes via firewall or proxy logs.

// Hunt: Non-browser processes communicating with public LLM API endpoints
// Context: ClosedQuorum-style AI-decision malware querying Gemini/DeepSeek/Qwen/Mistral
let LlmDomains = dynamic([
    "generativelanguage.googleapis.com",
    "api.deepseek.com",
    "dashscope.aliyuncs.com",
    "api.mistral.ai",
    "open.bigmodel.cn"
]);
let Browsers = dynamic([
    "msedge.exe", "chrome.exe", "firefox.exe", "brave.exe", "opera.exe",
    "Code.exe", "cursor.exe", "python.exe", "node.exe"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (LlmDomains)
| where InitiatingProcessFileName !in~ (Browsers)
| summarize Connections = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            RemoteUrls = make_set(RemoteUrl),
            RemoteIPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessSHA256
| extend UnsignedOrTempPath = InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
| sort by Connections desc;

// Companion query: command lines referencing LLM endpoints or API key headers
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "generativelanguage.googleapis.com", "api.deepseek.com",
    "dashscope.aliyuncs.com", "api.mistral.ai", "x-goog-api-key")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          AccountName, SHA256
| order by TimeGenerated desc;

Tune the first query by exporting the InitiatingProcessFileName values you see over a week, validating which are sanctioned AI tooling (developer IDEs, approved copilots), and converting those into an allowlist. Anything left after that baseline deserves investigation — especially unsigned binaries executing from user-writable paths (%APPDATA%, %TEMP%, C:\ProgramData).

Velociraptor VQL

Use this hunt artifact across your Windows fleet to surface live connections and process command lines tied to LLM API endpoints. It pairs netstat() for egress state with pslist() for command-line evidence of LLM key material or recon staging.

-- Hunt: Processes communicating with or referencing public LLM API endpoints
-- Context: ClosedQuorum-style AI-decision malware (Gemini, DeepSeek, Qwen, Mistral)

-- Part 1: Command lines and executable paths referencing LLM API material
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(generativelanguage\.googleapis\.com|api\.deepseek\.com|dashscope\.aliyuncs\.com|api\.mistral\.ai|x-goog-api-key)'
   OR Exe =~ '(?i)(\\\\AppData\\\\|\\\\Temp\\\\|\\\\ProgramData\\\\).*\.(exe|dll)$'

-- Part 2: Live TCP connections — review Raddr against resolved LLM provider ranges;
-- enrich Raddr with a DNS/reputation lookup artifact in your environment
SELECT Pid, Name, Status, Laddr, Raddr, Family, Type
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name !~ '(?i)(msedge|chrome|firefox|brave|opera)'
ORDER BY Name

For Part 2, Velociraptor's netstat() returns remote IPs rather than hostnames — enrich the output by joining against your DNS cache (SELECT * FROM Artifact.Windows.Network.DNSCache() style artifact, or a passive DNS source) and flag any remote IP whose PTR or observed query history includes the LLM provider domains. A standalone process holding an established 443 session to infrastructure that also answers for api.deepseek.com or generativelanguage.googleapis.com is your investigation pivot.

Remediation & Hunt Script

The following PowerShell script audits a host for established connections and DNS cache entries tied to LLM API providers, identifies the owning processes, and — when run with -Block — creates outbound firewall rules blocking those endpoints (resolving current IPs first). Run it on servers and workstations where no sanctioned LLM integration exists. Prefer enforcing the block at the proxy/egress gateway for durable coverage; the local firewall rules are a stopgap.

#Requires -RunAsAdministrator
# ClosedQuorum-style AI-malware audit & egress containment script
# Usage:  .\Audit-LLMEgress.ps1           (audit only)
#         .\Audit-LLMEgress.ps1 -Block    (audit + local egress block)
param([switch]$Block)

$llmDomains = @(
  'generativelanguage.googleapis.com',
  'api.deepseek.com',
  'dashscope.aliyuncs.com',
  'api.mistral.ai',
  'open.bigmodel.cn'
)

Write-Host "[*] Checking DNS cache for LLM API resolutions..." -ForegroundColor Cyan
$dnsHits = Get-DnsClientCache | Where-Object {
  $d = $_.Entry; $llmDomains | Where-Object { $d -like "*$_*" }
}
$dnsHits | Format-Table Entry, Data, TimeToLive -AutoSize

Write-Host "[*] Resolving LLM endpoints for connection correlation..." -ForegroundColor Cyan
$llmIPs = foreach ($dom in $llmDomains) {
  try { (Resolve-DnsName -Name $dom -Type A -ErrorAction Stop).IPAddress } catch {}
}

Write-Host "[*] Checking active TCP connections to LLM provider IPs..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $llmIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
  $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
  $path = (Get-CimInstance Win32_Process -Filter "ProcessId=$($c.OwningProcess)").ExecutablePath
  $sig = if ($path) { (Get-AuthenticodeSignature $path).Status } else { 'Unknown' }
  [PSCustomObject]@{
    RemoteIP   = $c.RemoteAddress
    Process    = $proc.ProcessName
    PID        = $c.OwningProcess
    Path       = $path
    Signature  = $sig
    Suspicious = ($path -match 'AppData|Temp|ProgramData|Users\\Public') -or ($sig -ne 'Valid')
  }
}

Write-Host "[*] Checking recent process creation for LLM endpoint references (Sysmon EID 1 / Security 4688)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match ($llmDomains -join '|') } |
  Select-Object -First 25 TimeCreated, Message | Format-List

if ($Block) {
  Write-Host "[!] Creating outbound block rules for resolved LLM IPs..." -ForegroundColor Yellow
  foreach ($ip in ($llmIPs | Sort-Object -Unique)) {
    New-NetFirewallRule -DisplayName "BLOCK-LLM-API-$ip" -Direction Outbound `
      -Action Block -RemoteAddress $ip -Protocol TCP -RemotePort 443 `
      -Profile Any -ErrorAction SilentlyContinue | Out-Null
  }
  Write-Host "[+] Local firewall blocks applied. Verify sanctioned AI tooling is unaffected." -ForegroundColor Green
}
Write-Host "[*] Audit complete. Investigate any unsigned process or user-writable-path binary above." -ForegroundColor Cyan

Remediation

There is no patch for ClosedQuorum — it abuses legitimate APIs, so remediation is architectural and procedural:

1. Egress control, applied with nuance. Implement outbound allowlisting at the proxy or egress gateway. For server VLANs and standard workstation OUs, block generativelanguage.googleapis.com, api.deepseek.com, dashscope.aliyuncs.com, api.mistral.ai, and similar LLM API endpoints outright; developers who need LLM access should get it through an authenticated, logged proxy exception tied to sanctioned tooling — not blanket firewall allows.
2. Govern your own LLM API keys. ClosedQuorum's model queries require API keys. Inventory your organization's Gemini/DeepSeek/Qwen/Mistral keys, enforce spend alerts and usage anomaly detection on those accounts, and rotate any key found in code repositories, CI logs, or endpoint telemetry. A sudden spike in small, prompt-heavy requests from unfamiliar source IPs is a compromise indicator on the billing plane.
3. Application control. Deploy WDAC or AppLocker policies that block unsigned executables from user-writable paths (%APPDATA%, %TEMP%, C:\ProgramData). This forces the implant into more detectable staging behavior regardless of how its decision engine evolves.
4. Baseline discovery-command noise. Know which management tools (SCCM, monitoring agents) legitimately run systeminfo/nltest/tasklist, then alert on everything else — especially recon spawned by processes with no interactive shell parent.
5. If you confirm a hit: isolate the host via EDR network containment, capture memory before remediation (the prompt/response loop and embedded API keys live in process memory and are high-value forensic artifacts), dump the implant binary and extract hardcoded keys and endpoints, then report key theft to the affected LLM providers so they can revoke attacker keys. Treat any host the malware profiled as fully exposed — rotate credentials reachable from that context and review adjacent systems for LLM-recommended lateral movement.
6. Update threat models. Add "LLM API as C2/decision layer" to your detection engineering backlog and tabletop scenarios. ClosedQuorum will not be the last family to externalize its brain to a commercial model; detections built on the mechanics (process-to-LLM egress, recon-to-prompt staging) will outlive this specific malware.

ClosedQuorum is a proof point that attackers are operationalizing AI the same way enterprises are — to make faster, better-contextualized decisions. The defenders who adapt their egress controls and behavioral detections to this pattern now will be positioned for the wave of imitators that follows.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub