Four AI Models Vote On This Malware's Next Move. There's No Bad Address To Block.

Cisco's threat research group published a writeup Tuesday on a piece of Windows malware that doesn't have a boss. Instead of phoning home to a server the attacker runs, it asks four commercial AI models what it should do next and then does whatever the majority picks. DeepSeek, Qwen, Mistral and Google's Gemini, one vote each, and DeepSeek breaks any tie. They named it CLOSEDQUORUM, which is a fancy way of saying a committee with nobody on it.

Straight up before I go any further, because I don't like scaring business owners with things that haven't happened. Cisco has not confirmed this has been used on anybody. The copy they took apart ships with fake API keys in it and doesn't even run as distributed. What they did confirm is that the design works the way it looks, and they tied the developer to criminal forum posts about stolen card numbers going back to 2025. So it's a real build by a real person with a real motive, just not something known to be hitting shops in Perrysburg this week.

The voting is what got it written up everywhere. The part I think matters for a small business is where the thing hides.

There's nothing to put on the block list

Normally malware has to talk to a server somebody set up for it. That server has an address, and addresses get found and blocked. A lot of ordinary security works on exactly that, somebody keeps a list of known bad addresses and your firewall or your antivirus checks against the list.

CLOSEDQUORUM skips all of that. It calls the same AI endpoints that thousands of legitimate apps call every single day. Your invoicing software might call Gemini. Somebody's writing tool might call Mistral. There is no bad address to put on the list, because the addresses aren't bad.

Cisco says as much in their own advice to defenders. Stop chasing domains, watch behavior instead, because plenty of normal software talks to one AI provider. Far less normal software talks to three of them in the same minute while also digging around in Windows memory and quietly setting up a scheduled task for itself.

That's a good answer if you've got somebody watching. Most of the businesses I walk into around Toledo don't. What they have is a guy who comes in when the printer stops working.

What you can actually do about it

Know what AI your business legitimately uses. Written down somewhere, not just in somebody's head.

I know exactly how that sounds coming from a guy who runs AI workshops for a living, so here's why it matters right now specifically. Watching behavior only works if somebody can tell normal from odd. If nobody in your building can say which AI services your software and your people actually talk to, then nothing ever looks odd. Every call to every model just looks like Sharon in accounting using ChatGPT again.

The list doesn't need to be fancy. Which AI tools your team uses on purpose, which ones are baked into software you already pay for (a lot of them are now, and most owners have no idea), and whose accounts they're all running under. That's a half hour with whoever runs your day to day operations. I've done this exact exercise in workshops and it almost always turns up two or three tools nobody upstairs knew about.

Then ask whoever handles your computers one question. Can you see what our machines are talking to out on the internet? If the answer is no, that's worth knowing now instead of later. A five person shop in Sylvania doesn't need some enterprise security setup. It does need one person who could answer that question inside a week if something started feeling wrong.

The line from Cisco's writeup I keep coming back to is that this thing does not go offline when the attacker sleeps. Small businesses have been quietly protected for years by the plain fact that a human being had to decide you were worth giving up their Saturday for. That protection is the thing that's going away. What replaces it is knowing your own setup well enough to notice when something's off, and you can't buy that from anybody.