first publicly documented Windows implant to use LLMs for C2 A new Windows malware called CLOSEDQUORUM can query up to four LLM providers Google Gemini, DeepSeek, Qwen, and Mistral to autonomously select from predefined post compromise actions, including stealing users credentials and cryptocurrency wallets. Once deployed, the malware does not require continued commands from a human operator, according to Cisco Talos, which describes it as, to its knowledge, the first publicly documented Win
