Malware Activity
ClosedQuorum Malware Lets AI Models Decide How to Attack Windows Systems
ClosedQuorum is a new Windows malware implant that delegates its post compromise decisions to a “panel” of commercial AI models (Google Gemini, DeepSeek, Qwen, and Mistral) instead of a traditional attacker run command and control (C2) server. The Go based malware sends basic host details (name, OS version, admin status) and a fixed menu of actions to the models: steal, inject, persist, or move (the public build has no code for move). Each model must respond in a strict format where the malware tallies the votes and executes the winning action. “Steal” simultaneously dumps LSASS credentials, grabs saved browser passwords (Chrome, Edge, Firefox), and extracts data from MetaMask, Exodus, and Ethereum wallets. “Inject” generates shellcode and uses Early Bird APC injection or process hollowing. “Persist” creates Registry Run entries, scheduled tasks, and WMI event subscriptions disguised as Windows Update. Decisions and their rationales, along with stolen data, are sent to operators via a Discord webhook, enabling a largely automated attack chain once delivery occurs. The analyzed sample uses placeholder API keys and a dummy webhook While researchers have not seen full in the wild use, ClosedQuorum is viewed as the first publicly documented Windows malware to hand tactical C2 choices to AI models, likely seen as an early sign of attack chain automation that defenders should monitor via behavioral signals (AI service traffic plus LSASS access, injection, WMI persistence, Discord webhooks) rather than simple domain blocking. SHA-256 hash IOCs as well as Registry, File, and WMI artifact signals are included in the articles linked below.
Threat Actor Activity
ShinyHunters Claims Breach of FBI Jobs Portal and Theft of Agent Data
ShinyHunters, a prolific data extortion group, claims it breached the FBI’s jobs platform (FBIJobs[.]gov) and related systems, defaced the site with its Umbreon Pokémon mascot, and stole 2-3 TB of sensitive data on current and former employees and job applicants. The group says it exploited a new Oracle PeopleSoft zero‑day vulnerability for remote code execution (RCE), then moved laterally into FBI-managed AWS GovCloud and internal services including HR, Criminal Justice, Medlink, PEGA, PHIRE, and more. Samples of roughly 5,000 purported FBI employee records shared with media outlets have been partially verified, though the alleged zero‑day and full data volume remain unconfirmed. ShinyHunters frames the attack as retaliation for a May 2026 FBI FLASH report and PSA that, in the extortion group’s view, falsely portrayed the group as exaggerating access, conducting swatting, and engaging in sextortion. The group denies those behaviors, rejects being part of “The Com” cybercrime ecosystem and says this action against the FBI is not financially motivated, demanding instead that the FBI correct or remove the report. The FBI has acknowledged “unauthorized activity affecting FBIJobs[.]gov” and is investigating, while experts foresee and warn that detailed personnel data on law-enforcement staff could be abused for targeted fraud, intimidation, or follow‑on cyber and physical attacks. CTIX Analysts will continue to provide up-to-date reporting on this incident.
- Bleeping Computer: ShinyHunters FBI Hack Article
- The Hacker News: ShinyHunters FBI Hack Article
- The Record: ShinyHunters FBI Hack Article
- 404 Media: ShinyHunters FBI Hack Blog
Vulnerabilities
CISA Warns Ransomware Gangs Are Exploiting Critical TeamCity Authentication Bypass
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that ransomware groups are actively exploiting CVE-2026-63077, a critical authentication bypass vulnerability affecting JetBrains TeamCity On-Premises. TeamCity is a build management and continuous integration/continuous delivery (CI/CD) server. The flaw, tracked as CVE-2026-63077, can allow unauthenticated attackers with HTTP(S) access to execute arbitrary operating system commands with the privileges of the TeamCity server process. JetBrains patched the flaw on July 25, 2026, in TeamCity versions 2025.11.7 and 2026.1.3, while CISA added it to its Known Exploited Vulnerabilities (KEV) Catalog on August 5, 2026, and later flagged it as being used in ransomware attacks. Successful exploitation could expose sensitive TeamCity data, configurations, and stored credentials, as well as modify server states, and compromise build artifacts and downstream CI/CD pipelines. Shadowserver is currently tracking over 160 Internet-exposed TeamCity servers that remain vulnerable, down from roughly 700 immediately after disclosure. This vulnerability is the fourth TeamCity vulnerability since October 2023 that CISA has linked to both active exploitation and ransomware activity, underscoring the continued targeting of exposed CI/CD infrastructure by cybercriminal and state-sponsored threat actors. CTIX analysts urge any affected organizations to ensure that they are running patched infrastructure to prevent exploitation.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
