A new Windows malware called ClosedQuorum leverages multiple AI models to autonomously decide its attack strategy after gaining system access. The threat uses Google Gemini, DeepSeek, Qwen, and Mistral to determine post-compromise actions.
Security researchers have identified ClosedQuorum, a Windows malware that represents a significant shift in attack sophistication by integrating large language models into its operational logic.
The malware queries multiple AI services—Google Gemini, DeepSeek, Qwen, and Mistral—to dynamically determine which actions to execute during the post-compromise phase of an attack. This approach allows the malware to adapt its behavior based on AI-generated recommendations rather than relying on hardcoded instructions.
The use of multiple AI providers suggests the attackers are building redundancy into their system, likely to maintain functionality if access to any single service is restricted or detected.
This development highlights how threat actors are evolving their techniques to leverage publicly available AI services. The autonomous decision-making capability could make detection and response more challenging for security teams, as attack patterns may vary significantly between compromised systems.
Organizations should monitor for suspicious queries to external AI services and review network logs for unusual connections to these platforms.
An IT mistake at English hospitals resulted in the loss of 11 years of viewing history for maternity patient records. Hospital staff recovered the underlying patient care data, though access logs remain unrecoverable.
Researchers have identified stolen credentials as a critical vulnerability threatening America's water infrastructure. The exposed passwords create direct pathways for attackers to access essential systems.
Microsoft's Digital Crimes Unit has shut down EvilTokens, a phishing-as-a-service platform that compromised over 12,000 Microsoft accounts across 10,000+ organizations.
A webinar tomorrow examines critical early response decisions in Google Workspace breaches. Real-world incident analysis shows which actions limit damage and which escalate the impact.