Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
Original title: A quiet week in infosec <.<
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
Cisco Talos says it discovered NIK C2, a Go-based Windows command-and-control implant that embeds an OpenAI model in the attack loop. The implant can dump credentials, stream keystrokes, and deploy screen-locking ransomware, using the victim's own API keys so requests are not tied to the operator's infrastructure. Talos urges monitoring for unusual proxy use, unexpected PowerShell, and access to browser databases or crypto wallets, and points to a ClamAV signature and IOCs. The rest of the newsletter is commentary plus links to other outlets' PHP, Brotli, GitHub, GMO, and Interpol stories.
Unconfirmed: Talos does not say how widely NIK C2 is deployed or name any victims.
- NIK C2 processes harvested data with an integrated OpenAI model during the session.
- Operators hijack the victim's OpenAI API keys to pay for those requests.
- Talos says local processing removes the usual offline analysis delay.
- A ClamAV signature and indicators are in the full Talos blog.
Impact: Credential dumping, keystroke capture, and screen-locking ransomware
- 1.Watch for unusual local proxy routing and unexpected PowerShell execution.
- 2.Check for unauthorized access to browser databases or crypto wallets.
- 3.Use the ClamAV signature and IOCs from the Talos blog.
- Vendors
- Cisco
- Products
- ClamAV
- Malware
- NIK C2
- Organizations
- Cisco Talos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0cf0271c3564881fce95f44c649bd745 | 3260418c2271b863c567e40e842adbab3c57023cb72de590ea377d MD5: 0cf0271c3564881fce95f44c649bd745 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 207d9d891ac756b2bfad88aba5682c65 | caf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f MD5: 207d9d891ac756b2bfad88aba5682c65 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | cca616647db9370c88998ae25da6997f | 6bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | f1fe671bcefd4630e5ed8b87c9283534 | 24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 MD5: f1fe671bcefd4630e5ed8b87c9283534 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| sha256 | 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 | 5da6997f.exe Detection Name: Win.Tool.Kmsauto::1201 SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 MD5: f1fe671bcefd4630e5ed8b87c9283534 Talos Rep: https://ta |
| sha256 | 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d | lware files from Talos telemetry over the past week SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d MD5: 0cf0271c3564881fce95f44c649bd745 Talos Rep: https://ta |
| sha256 | 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f | ple.exe Detection Name: W32.9F1F11A708-100.SBX.TG** SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://ta |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | : KMSAuto++.exe Detection Name: HackTool:WZTeam-tpd SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta |
| sha256 | fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f | to Net.exe Detection Name: W32.58D6FEC4BA-95.SBX.TG SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f MD5: 207d9d891ac756b2bfad88aba5682c65 Talos Rep: https://ta |
From the original article
5 min read at blog.talosintelligence.com
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node. js has joined in, but underneath it all, there are still good people doing good work.
By William Largent · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.