Front Page

AI-Enabled Attacks

Four AI Models, One Vote: Cisco Talos Uncovers Windows Malware That Lets an LLM Panel Decide What to Steal Next

Cisco Talos disclosed CLOSEDQUORUM on September 22, describing it as the first publicly documented Windows implant to delegate tactical command-and-control decisions to a panel of commercial large language models. On each run, the malware queries up to four AI services — DeepSeek, Qwen, Mistral, and Google Gemini, reached through OpenRouter — with the infected machine's computer name, Windows version, and admin status, then asks each model to pick one of four actions: steal, inject, persist, or move. Each model must answer in a fixed format or its vote is discarded; the action with the most votes wins, and if no model returns a usable answer the malware simply retries rather than falling back to a default. Talos found the sample using CAIRN, a new open-source toolkit it released the same day for hunting AI-integrated malware by scanning metadata — prompt templates, provider API endpoints, jailbreak terms — without ever executing the binary.

The "steal" action dumps LSASS memory for Windows credentials and pulls saved passwords from Chrome, Edge, and Firefox alongside MetaMask, Exodus, and other crypto wallet data; "inject" runs code in other processes via Early Bird APC injection or process hollowing; "persist" installs three separate mechanisms — a Registry Run key, a scheduled task, and a WMI event subscription that re-checks every 60 seconds. Stolen data is encrypted, chunked into 1,900-byte pieces, and exfiltrated through Discord webhooks. Forensic priority: hunt a Registry Run value named "WindowsUpdate," a PowerShell script at C:\Windows\Temp\wmi.ps1, and WMI event subscriptions using Windows Update-themed names; capture memory before remediation to recover the model responses that drove the malware's decisions, since that log is itself an evidentiary record of attacker intent.

Nation-State

The Friend Request That Wasn't: Iran's CHOSEN BRICK Spyware Impersonates Trusted Contacts to Surveil Dissidents and Journalists

The UK's NCSC, the FBI, and the Netherlands' AIVD issued a joint advisory this week exposing CHOSEN BRICK, a Windows spyware family Iranian state actors have used since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. The attack begins with social engineering over WhatsApp or Telegram, with operators impersonating trusted contacts or technical-support agents to deliver malicious files disguised as legitimate software — fake Norton Antivirus, Adobe Flash Player, and KeePass installers among them. Once installed, CHOSEN BRICK leverages Telegram's own infrastructure to exfiltrate messages, contacts, files, screenshots, and microphone audio, giving operators a running picture of a target's associates and movements.

Personal information belonging to some victims has since surfaced on pro-Iranian leak sites, a step beyond surveillance into potential harassment and physical risk for people already identified as threats to the regime. Forensic priority: treat any unsolicited "trusted contact" file-share over WhatsApp or Telegram as a live intrusion attempt regardless of sender familiarity, verify installer authenticity against vendor-signed hashes before running anything received through a messaging app, and for suspected victims, prioritize Telegram session and device-authorization review — the malware rides the platform's own trust model rather than a separate C2 channel.

Threat Bulletin

ACTIVE EXPLOIT
CVE-2026-5430

WSO2 API Manager — improper cryptographic-signature verification lets a JWT signed with an unsupported algorithm bypass authentication entirely; CVSS 9.8. watchTowr's honeypots captured forged tokens carrying baked-in administrator privileges beginning September 13. Affects API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway 4.5.0–4.6.0. Forensic Note: Review JWT validation logs for tokens signed with unexpected or unsupported algorithms, audit all administrator accounts created or modified since September 13, and patch immediately — this is an aggregation point for internal service credentials.

ACTIVE EXPLOIT
CVE-2026-51990

Tencent Sogou Input Method — a one-click RCE chaining unvalidated command-line argument injection in the sgbiz: URI handler, unrestricted navigation in a CEF-based webview, and an outdated, unsandboxed Chromium 80 engine. China-aligned actor UNC3569 is exploiting it to deploy the GrayRabbit backdoor (see Malware Spotlight). Patched in version 16.3.0.3498. Forensic Note: Confirm Sogou IME is updated past 16.3.0.3498 on every Windows host, audit browser and URI-handler history for sgbiz: invocations, and treat any host still on the vulnerable Chromium 80 component as unpatched regardless of reported version string.

Malware Spotlight

GrayRabbit — The Backdoor Riding a Chinese Input Method's Chromium Flaw

GrayRabbit is a modular backdoor linked to UNC3569, a China-based actor spanning both cybercrime and contractor-for-hire espionage, dropped via the Sogou Input Method one-click exploit chain above. Once resident, it opens a reverse shell and can execute processes, load additional plugins, write data directly to the interactive shell, upload files to its C2, collect system information, and terminate itself on command — a compact but complete remote-access toolkit riding in through a keyboard utility hundreds of millions of Windows users have installed. Forensic Note: Hunt for reverse-shell network connections originating from IME-related processes, review plugin-load activity for the backdoor's modular components, and treat any Sogou-related process spawning a shell as compromise, not a false positive.