Next week, on May 30th the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) opens the 10th International Conference on Cyber Conflict, CyCon 2018. The anniversary event focuses on the theme of maximising effects in the cyber domain.
↧
The 10th CyCon Starts Next Week
↧
The 10th CyCon Starts Next Week
↧
↧
The 10th CyCon Hosts 700 Cyber Experts in Tallinn
↧
CyCon 2019 Theme is Silent Battle in Cyber Space
↧
Romania to Join the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn
The Prime Minister of Romania, Mrs. Viorica Dăncilă, announced today during her visit to Estonia that Romania looks forward to joining NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in 2019. NATO-accredited cyber defence hub in Tallinn welcomes the decision of Romania to become another NATO Ally to join the Centre.
↧
↧
Colonel Jaak Tarien to Become Director of the NATO Cooperative Cyber Defence Centre of Excellence
As of 1 September 2018 Colonel Jaak Tarien, former Commander of Estonian Air Force for the past six years, will assume the role of Director of the NATO Cooperative Cyber Defence Centre of Excellence based in Estonia.
Merle Maigre, current Director of CCDCOE, will take on a new challenge in September by joining CybExer Technologies, an Estonian cyber security company which is rapidly expanding its operations both in Estonia and abroad.
↧
Colonel Jaak Tarien assumes command of NATO CCDCOE
Colonel Jaak Tarien, until recently the long-term Commander of Estonian Air Force, assumed today from Merle Maigre the role of Director of the NATO Cooperative Cyber Defence Centre of Excellence based in Tallinn.
↧
CyCon 2019 Papers are Expected by 1 October
The Call for CyCon 2019 Papers is open until 1 October 2018. The theme for the eleventh International Conference on Cyber Conflict, hosted by the NATO Cooperative Cyber Defence Centre of Excellence, is ‘Silent Battle’. CyCon 2019 will take place in Tallinn, Estonia, from 28 to 31 May 2019.
The International Conference on Cyber Conflict, CyCon, is entering its second decade. Throughout the years, CyCon has established itself as a prominent multidisciplinary conference, introducing keynotes and panels focusing on the technical, legal, policy, strategy and military perspectives of cyber defence and security. This is undoubtedly thanks to the amount of high-quality original academic research presented at the conference. In 2018, the Academic Review Committee selected 22 articles that were presented at the conference and published in the proceedings.
↧
NATO CCDCOE brings improvement through practice
The NATO Cooperative Cyber Defence Centre of Excellence contributes this week to the setup and organisation of NATO’s largest cyber exercise Cyber Coalition 2018 taking place in Tartu, Estonia. This year, the experts of the Centre contributed to the operational and legal part of the exercise scenario, adding respective challenges to the participating cyber experts across the Alliance.
↧
↧
New Study by the CCDCOE: Cyber Security Organisation in Turkey
New Study by the CCDCOE: Cyber Security Organisation in Turkey
A recent report by NATO CCDCOE “National Cyber Security Organisation: Turkey” outlines the current cyber security landscape in Turkey. Being the most recent issue of the NATO CCD COE’s National Cybersecurity Governance series, the report provides a comprehensive overview of the digital ecosystem in Turkey and describes the responsibilities of different national agencies designated to ensure the security in the cyberspace.
↧
GOP Senator calls for probe of Trump Jr. after wedding party bankrolled by Russian oligarch
BREAKING: Train derails on Highway 6. 13 Union ... Police ID 'Unknown Wanderer' found dead in church, probe possible tie to 1982 Tylenol murders.
↧
Texas executes man for a triple killing, days after other man convicted in case was put to death
First Alert Weather ... Detectives say "Unknown Wanderer" worked at Lockheed Martin. Detectives say 'Unknown Wanderer' worked at Lockheed Martin · " ...
↧
Putin's Ukraine invasion has made Russia China's junior partner - Atlantic Council
But China refuses to bail out the Kremlin on anything but its own terms. Russian President Vladimir Putin arrived at the Shanghai Cooperation ...
↧
↧
Is the Deep Web Really Dangerous? Hacker | Original content: The Wild Project | - #shorts - YouTube
La Deep Web Es Realmente Peligros? Hacker Le Responde A Jordi Wild ... We Went Into the DARK WEB With a HACKER LIVE (Black Market, Substances…).
↧
US China Espionage Accusations Shadow Trump Xi Talks | WION Podcast - YouTube
US authorities have repeatedly accused Chinese-linked actors of cyber intrusions, economic espionage and intelligence operations, while Beijing ...
↧
FBI Hack Exposed FBI's Own Hacking Unit - 404 Media
For much of the previous decade, the ROU was focused on making and deploying tools to investigate the dark web ... dark web child abuse site the ...
↧
Bodies of teacher, 5th grade student recovered after school field trip to lake - WOWT
A teacher and a 10-year-old student are dead after an elementary school field trip to a lake, according to authorities in Iowa.
↧
↧
Ahead of Trump-XI Summit, Budd Leads Colleagues in Calling Out Chinese Effort To Flood ...
... cybersecurity threat if used by military personnel, potentially routing personal data and network access to the Chinese Communist Party. The ...
↧
Stanton Calls for AI Safeguards Ahead of Trump-Xi Meeting | Newsroom
WASHINGTON D.C. – Ahead of Trump's meeting with Chinese President Xi Jinping, U.S. Representative Greg Stanton (AZ-04) joined his Democratic ...
↧
Shot in the dark: did you buy an Isis Oceanic clear vinyl from half price books on 135th & Black Bob?
Shot in the dark: did you buy an Isis Oceanic clear vinyl from half price books on 135th & Black Bob? ... Because if you did, I have your missing side C ...
↧
Trump-backed Iowa US Senate hopeful calls for conclusion of Iran war - Fox News
Hasan Piker doubles down on anti-American rhetoric with al Qaeda remark ...
↧
↧
Africa Media Review for September 23, 2026
There have been growing ties between the Houthis and al Shabaab ... ISIL (ISIS) affiliate in West Africa Province, which operates in the area.
↧
A Melbourne man accused of joining terrorist organisation ISIS is launching his bid for ... - Instagram
An Australian man is expected to face court today over allegations he shared propaganda and violent extremist material for the terrorist group ISIS.
↧
OpenAI grants Ukraine access to Daybreak to defend mounting Russian cyberattacks
Russia has escalated its cyberattacks as the war rages on. Ukraine's national cyber incident response team handled about 6,000 cyberattacks in 2025 ...
↧
Hacking group 'ShinyHunters' claims massive FBI employee data breach | Fox News Video
Hacking group 'ShinyHunters' claims massive FBI employee data breach. ustice correspondent David Spunt discuss an alleged cyberhacking threat after ...
↧
↧
President Trump Reasserts Commitment to the Western Hemisphere at UNGA
U.S. President Donald Trump doubled down on the United States ... ISIS of the Western Hemisphere”: “They're enemies at war with civilization ...
↧
President Trump Reasserts Commitment to the Western Hemisphere at UNGA
President Trump discussed the U.S. strategy to target narcoterrorists, calling the drug cartels the “ISIS of the Western Hemisphere”: “They're ...
↧
69-year-old man hit and killed while getting mail, police say - KMOV
First Alert Forward: Ballpark Village ... Police ID 'Unknown Wanderer' found dead in church, probe possible tie to 1982 Tylenol murders.
↧
Factbox-OpenAI data breach latest in long list of hacks in Australia | The Mighty 790 KFGO
... files, in what could be the first known instance of an AI agent hacking a government website. The ...
↧
↧
Accused ISIS recruiter launches bid for bail - YouTube
A Melbourne man accused of joining terrorist organisation ISIS is launching his bid for bail today. The 65-year-old was arrested at his Carlton ...
↧
Taiwan upgrades maritime patrol capacity for vulnerable South China Sea outpost | Reuters
Cybersecurity· Space · Disrupted · Investigations · Sports · World Cup ... Taiwan Coast Guard patrol ships are seen during a drill held about 30 ...
↧
Zelenskyy says Ukraine sent 2 North Korean prisoners of war to South Korea - WRAL
SEOUL, South Korea (AP) — Ukraine has sent two North Korean prisoners of war to South Korea, Ukrainian President Volodymyr Zelenskyy told the U.N. ...
↧
AI Detects a Conspiracy Against the Father! - YouTube
Go to channel Iqrar Ul Hassan · Dark Web Danger | How to Shield Pakistani Kids from Evil | Iqrar ul Hassan. Iqrar Ul Hassan•1M views · 51:50.
↧
↧
What is dark AI? How it works, what it looks like, and how to stay safe - NordVPN
Criminals can abuse existing AI tools or buy ready-made ones from underground forums, dark web marketplaces, and encrypted chat groups. The most ...
↧
Former school worker accused of hitting student - WLBT
First Alert Weather · Aging Untold · 3 On Your Side Investigates · Today at 11 ... "Unknown Wanderer" in 1982 cold case identified. (KBOI) · 'Unknown ...
↧
Gaza's $2.4bn recovery plan unveiled at UN as questions over feasibility remain - YouTube
The U.S. mission that fought ISIL in Iraq is ending. What comes next is harder. | This Is America. Al Jazeera English. New. 10K views · 18:24.
↧
Who is Miguel Sánchez, the Mayor of Juchitán Arrested for Extortion and Ties to the Drug Cartel?
Who is Miguel Sánchez, the Mayor of Juchitán Arrested for Extortion and Ties to the Drug Cartel? @GrupoFormula-RF31 likes868 views1 hour ago more.
↧
↧
Twelve Identified by Police over Suspected Drug Trafficking in Aljezur - Ground News
Drug Trafficking · Philadelphia· 14 hours ago. Philadelphia Drug Bust: Authorities Announce Takedown of Cocaine Ring Tied to Mexican Drug Cartel. 45 ...
↧
Diez acusados tras desmantelar red de cocaína en Filadelfia vinculada a cártel mexicano
The DTO allegedly coordinated with a Mexican drug cartel to transport more than 300 kilos of cocaine from Mexico to… pic.twitter.com/SMvrV7yJdU.
↧
U.S.-China trade truce extended, Bessent says, as Xi begins visit - CNBC
Cybersecurity· AI · Enterprise · Internet · Media · Mobile · Social Media · CNBC ... China Peng Liyuan at the foot of the Chinese leader's jet. Aly ...
↧
Women's Soccer vs California Baptist on 09/23/2026 - Box Score - Cal Poly Athletics
GOAL by CP Liaty, Sam Assist by Salazar-Ortega, Isis and Clarke, Mya. 1. 2. Team Statistics ...
↧
↧
25 Years On, Al-Qaeda Is Less Visible, Still Dangerous - The Nation
A quarter-century after the September 11 attacks, al-Qaeda continues to present a paradox for analysts and counterterrorism authorities.
↧
President Trump Participates in an Arrival Ceremony with the President of China
Office of the National Cyber Director · Office of National Drug Control Policy · Council on Environmental Quality. Media. Photo Gallery · Video ...
↧
IRGC strikes cargo vessel in Strait of Hormuz as tensions rise | Fox News Video
Hasan Piker doubles down on anti-American rhetoric with al Qaeda remark ... Jack Keane warns US-Iran conflict is a 'test of wills'. 8:10 · Dr Oz ...
↧
Alleged top ISIS propagandist arrested in Australia - 1News
Police allege the Somali-born Australian citizen pledged allegiance to the Islamic State of Iraq and Syria between 2018 and 2020. He is alleged to ...
↧
↧
Media mogul's MGM retreat dodges risky China wager - Reuters
... cyber attack in Las Vegas, Nevada, U.S., September 13, 2023. REUTERS/Bridget Bennett Purchase Licensing Rights , opens new tab. HONG KONG, Sept 24 ...
↧
Former school worker accused of hitting student - WILX
First Alert Weather · Livestream · Closings · Decision 2026 · Sports · Make An ... "Unknown Wanderer" in 1982 cold case identified. (KBOI). 'Unknown ...
↧
New Zealand says China is its most persistent state-backed cyber threat
New Zealand report identifies China as its most persistent state-backed cyber threat, with foreign espionage actively targeting key government, ...
↧
'Unknown Wanderer' in 1982 cold case identified - KFVS12
... Unknown Wanderer" in 1982 cold case identified. (KBOI) ... First Alert Weather · Heartland Sports · Community · About Us · Watch ...
↧
↧
Is 'The Daily Wire' Film About ISIS Attacking a College Controversial? - Algemeiner.com
×. Is 'The Daily Wire' Film About ISIS Attacking a College Controversial?The Algemeiner. View · About Us· Contact Us· Epaper. Wednesday, September ...
↧
Is 'The Daily Wire' Film About ISIS Attacking a College Controversial? - Algemeiner.com
A screenshot from “Run Hide Fight: Infidels.” While a member of ISIS points a gun at her head, a female college student is forced to say that her ...
↧
China-Linked Hackers Spied on Shipping in Seven EU States | SOFX
Unsealed U.S. court filings tie the group to Beijing; ENISA's June 2026 Cyber Europe drill simulated a rail-and-maritime attack. ... SOFX, “Coast Guard ...
↧
Air Force Cuts Civilian Jobs from China-Focused Research Center
The Air Force will slash positions at its research center for Chinese military aviation, prompting concern of diluting focus on China ... cyber, and ...
↧
↧
How the 'poisonous tide' of disinformation spreads division and despair - The Guardian
Sophie Williams-Dunning, a cyber analyst at the Royal United ... China and Iran have both used deepfake newscasters to advance their goals.
↧
Xi arrives for state visit amid U.S.-China trade tensions and AI concerns | PBS News
He says that they're more worried about cyber risks, hacking companies, and they don't share, China does not share the same concerns that we have ...
↧
At U.N. Meeting, Syria's Leader Is Strengthened, but Faces a Difficult Test
President Ahmed al-Sharaa of Syria seated before U.S. and Syrian flags. President Ahmed al-Sharaa of Syria has met in person with President Trump ...
↧
Opinion | The U.S. and China Are Far Apart on A.I. Safety - The New York Times
What Mr. Xi actually said in Chinese was that China's ... cyberdefense tool approaching the abilities of Mythos 5, Anthropic's powerful cybersecurity ...
↧
↧
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos finds CLOSEDQUORUM, malware that lets four commercial AI models vote on its next move, with no human operator required.
Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction.
CLOSEDQUORUM is the first Windows malware they’ve seen that hands its tactical decisions to a panel of commercial AI models instead of a human operator. Once it lands on a machine, it doesn’t wait for instructions. It asks four different large language models what to do next, tallies their answers, and acts on whichever choice gets the most votes.
“CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets.” reads the report published by Talos. “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.”
The name makes sense. A quorum needs a minimum number of people to make a decision, and this one has exactly four members: DeepSeek, Qwen, Mistral, and Google Gemini. There is no human involved. Talos discovered the malware using CAIRN, a new open-source toolkit designed to find threats that use AI. This is the first case study from the project.
Most discussions about AI and cybercrime have focused on speed and scale. Attackers can write phishing emails faster, create more malware variants, and carry out more attacks with less effort. That’s true, but in these cases, a human is still in control, choosing the targets and deciding when to attack.
Talos calls what CLOSEDQUORUM does something different: effort displacement. It’s not making an operator faster at their job. It’s removing them from an entire phase of the job.
“A third dimension has received less attention in the malware space: effort displacement. This is not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system. Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck.” Talos continues. “Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.”
On execution, the malware gathers basic host information, hostname, OS version, admin status, and folds it into a prompt sent to each of the four models in turn. Each model has to answer with one of exactly four options: steal, inject, persist, or move. Anything that doesn’t match the format gets thrown out.
Steal runs three things at once: dumping credentials from LSASS memory, pulling saved passwords out of Chrome, Edge, and Firefox, and scanning for crypto wallets like MetaMask and Exodus. Inject writes shellcode and picks a delivery method depending on what the model recommends. Persist sets up the usual mechanisms to survive a reboot. Move is defined in the code but has no actual function behind it yet, so calling it does nothing.
If the four models disagree and end up tied, there is a fixed order for breaking the tie: DeepSeek first, followed by Qwen, Mistral, and Gemini. It’s not a sophisticated system. The model that loads first in the code simply gets the final say.
The malware encrypts everything it steals and sends it out through a Discord webhook instead of a traditional command-and-control server. That’s the interesting part. Security teams can block domains, IP addresses, or certificates, but a Windows process quietly connecting to four AI APIs and a chat service can look like normal application traffic, at least until its other activity raises a red flag.
“Stolen material arrives AES-256-GCM encrypted in the operator’s Discord channel as base64 code blocks.” continues the report. “CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors. No single indicator fully identifies the architecture, but the combination is distinct: Repeated execution at randomized 5 – 15-minute intervals; AI-provider API traffic originating from an unexpected Windows executable; Similar requests potentially sent to several model providers within a short interval; Structured prompts containing host context or offensive capability language (Note: This would likely only visible through TLS inspection or provider-side telemetry); Numerous known malware techniques for process injection, LSASS access, or persistence creation; Discord webhook communication from the same process or host.”
The encryption is worth a second look too, mostly because it’s weaker than it sounds. The key comes from the current date, not a proper secret, which means the malware’s own developer could decrypt any operator’s stolen data just by knowing what day it is. That’s obfuscation dressed up as security, and it’s a detail that says something about how this whole operation was actually built.
The public sample Talos pulled apart is inert. It ships with placeholder API keys and a dummy webhook, so nobody’s running the live version through this exact binary. Development builds tell a different story though, with real credentials baked in at compile time, which points to a model where a developer builds custom versions for paying operators, credentials-as-a-service, basically, with the AI orchestration as the selling point.
There is also a trail pointing to the developer. Artifacts found in the malware connect the person behind it to carding forum posts dating back to 2025. That suggests this is not just an academic proof of concept created in a lab. It appears to come from someone already involved in cybercrime and testing how much autonomy AI can add to their existing activities.
That doesn’t make the malware impossible to stop. It relies on commercial AI APIs, which can rate-limit requests, reject them, or return responses that don’t match the expected format. Its predictable tie-breaking also makes it easier to identify.
Talos recommends watching for Windows binaries that contact several AI providers and Discord within a short period while also accessing LSASS or creating suspended processes. None of these signs is enough on its own, but seeing them together is highly unusual.
“CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today.” concludes the report. “As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI. “
Talos technical writeup includes the YARA rule and the MITRE ATT&CK mapping.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
↧
'Unknown Wanderer' in 1982 cold case identified - WRDW
... Unknown Wanderer" in 1982 cold case identified. (KBOI) ... First Alert Weather · 12 On Your Side Investigates · Latest Newscasts ...
↧
'Unknown Wanderer' cold case: Detectives collected personal items - WRDW
... Unknown Wanderer" cold case: Detectives collected personal items. (KBOI) ... First Alert Weather · 12 On Your Side Investigates · Latest Newscasts ...
↧