Talos details NIK C2, an AI-enabled Windows implant seen live
Original title: NIK C2: The new AI-enabled command-and-control framework
Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.
Cisco Talos says it observed NIK C2 in the wild: a Go-based 64-bit Windows implant with dual-channel command and control over TLS WebSockets on port 443 and HTTP polling. It can dump credentials, stream keystrokes, hijack RDP sessions, hollow processes, and lock the desktop for Bitcoin or USDT. An ai_generate command sends prompts to OpenAI’s Chat Completions API from the victim, falling back to the host’s OPENAI_API_KEY. Talos ties live infrastructure to 87.120.196.120 and total-sitevv.lol.
Unconfirmed: Talos says moderate confidence that NIK C2 is fully functional rather than only a proof of concept.
- Samples were built with Go 1.23.4 and show at least three versions.
- Traffic uses AES-256-GCM from a hardcoded seed.
- C2 tiers are runtime URLs, an encrypted server list, and a hardcoded fallback.
- The AI call runs synchronously with a 60-second timeout.
- A certificate common name nik-panel matches strings in the implant.
Impact: Credential theft, keylogging, and screen-lock ransomware
- 1.Block the reported C2 domain total-sitevv.lol and address 87.120.196.120.
- 2.Look for unexpected OpenAI Chat Completions calls from Windows hosts.
- ATT&CK
- T1071.001 Web ProtocolsT1003 OS Credential DumpingT1056.001 KeyloggingT1055.012 Process HollowingT1563.002 RDP Hijacking
- Vendors
- OpenAI
- Malware
- NIK C2
- Organizations
- Cisco Talos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | total-sitevv.lol | ver at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”. The C2 server hosted an SSL/TLS certificate (serial num |
| ipv4 | 87.120.196.120 | ctor hosted the NIK C2 framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”. The C2 serve |
| sha1 | 7d16381a9de823943b5a0987dbd0f26edf22052b | The C2 server hosted an SSL/TLS certificate (serial number 7d16381a9de823943b5a0987dbd0f26edf22052b and jarm:"28d28d28d00000000042d42d0000001f361a1bf80ed39a1e3 |
From the original article
13 min read at blog.talosintelligence.com
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
By Chetan Raghuprasad · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.