Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
The Closed Quorum: Inside the first reported autonomous AI C2 implant
Threat Actors
Malware Families
Excerpt
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project , exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.  This malware is a useful reference example of how attackers can collapse the decision space of a particular attack phase into a constrained…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 | High | Score 85/100 | First seen |
| SHA256 | 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb | High | Score 85/100 | First seen |
| SHA256 | c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f | High | Score 85/100 | First seen |
| SHA256 | c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 | High | Score 85/100 | First seen |
| SHA256 | eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5 | High | Score 85/100 | First seen |
| SHA256 | f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c | High | Score 85/100 | First seen |
IOC Relationship Graph
Building graph…