NIK C2: The new AI-enabled command-and-control framework

What it is

NIK C2 is a command-and-control framework seen in the wild by Cisco Talos. Its implant is a Go 1.23.4, 64-bit Windows RAT built from a Linux host (embedded path /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go). Talos found at least three implant versions. It assesses with moderate confidence that this is a working framework and not a proof of concept, based on a live server at 87.120.196[.]120 (domain total-sitevv[.]lol).

How it works

The ai_generate command takes prompt, api_key and model from the C2. It POSTs to https://api.openai.com/v1/chat/completions from the victim's IP, with a 60-second timeout. A hardcoded 68-byte system message precedes the operator's prompt. If no key is supplied, the implant reads the victim's OPENAI_API_KEY environment variable. The default model is gpt-4, and any model ID can be passed. Results return as status, code, model and usage.

Other behaviors the summary does not cover:

• Ransomware: it does not encrypt files. It backs up the MBR to mbr_backup.bin with a PowerShell raw read of \\.\PhysicalDrive0, then writes lock_screen.html and lock_start.bat to the temp directory. The batch file runs mshta.exe in a loop that relaunches the window within 5 seconds. A Run key named SystemLock provides persistence.
• Bootkit prep: it checks bcdedit /enum and Confirm-SecureBootUEFI, then drops a 16-byte placeholder bootkit.bin containing "NIK_BOOTKIT_PREP". No real bootkit was seen.
• Theft: it covers Wi-Fi keys (netsh wlan show profile name="" key=clear), browser databases with DPAPI unwrapping, Discord tokens, desktop and extension wallets, and a filesystem scan for seed and key files. Output goes to browserdata.zip. The keylogger polls all 256 virtual key codes and streams each keypress live.
• Evasion: it sets NtSetInformationProcess ProcessBreakOnTermination (0x1D), so killing the process causes a BSOD. It uses a fodhelper.exe UAC bypass through HKCU\Software\Classes\ms-settings\Shell\Open\command, patches AmsiInitFailed, and exits on debugger detection.
• Masquerade names: svchost.exe, simvol.exe and csrss.exe (in temp). The implant copies itself to %appdata%/Roaming/Microsoft/Network and sets autostart registry entries.

What to do

Hunt on these indicators from the page:

• Network: TLS to 87.120.196[.]120 or total-sitevv[.]lol, with a certificate CN of nik-panel, serial 7d16381a9de823943b5a0987dbd0f26edf22052b, and JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b.
• HTTP paths /api/c2/update (polled about every 250 ms) and /api/c2/result.
• Wire format: AES-256-GCM with a static key from a hardcoded seed. The page prints the decoded seed d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295 and the key 4887AFC0A574E9419A9695EF083460F58E4EF9A1C40793523CE112251273BDF9. Agent IDs look like ag_<16 hex>.
• Host: a Run key SystemLock, lock_start.bat, lock_screen.html, mbr_backup.bin or bootkit.bin in temp, and the string [NIK] Starting.
• Mutations of the fodhelper ms-settings key that revert within 2 seconds.
• Zeroed PE timestamps and file times of Nov 29, 1979.
• ClamAV signature: Win.Trojan.GoDiscorder-10060526-0.

The full IOC list is in Talos's GitHub repository, which this page links but does not reproduce.

Caveats

• The TLS client pins a certificate, so interception proxies will not see the traffic.
• The page gives no victim counts, attribution or delivery vector.
• The page says the OPENAI_API_KEY fallback bills the victim and logs requests under the victim's key. Teams holding that key on endpoints should treat unexpected usage as a signal.