Talos finds NIK C2 Windows RAT that calls OpenAI from infected PCs
Original title: New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs
The Go implant runs more than 52 commands, bills the victim’s OpenAI key, and shows a lock screen without encrypting files.
Cisco Talos says NIK C2 is a 64-bit Go Windows remote access tool with a built-in OpenAI client. Operators send prompts from an infected PC and read replies in the C2 panel; if no key is supplied, the implant uses the victim’s OPENAI_API_KEY and defaults to gpt-4. It steals credentials, wallets and surveillance data, supports remote control, and includes a non-encrypting lock-screen module. Talos points defenders to a live server, local artifacts and unexpected calls to api.openai.com.
Unconfirmed: Talos assigns moderate confidence that NIK C2 is a working framework rather than a proof of concept.
- C2 uses TLS WebSockets on port 443, with HTTP polling every 250 milliseconds.
- Traffic is AES-256-GCM; Talos saw 87.120.196.120 and total-sitevv.lol.
- The lock screen demands Bitcoin and USDT and is relaunched via mshta.exe.
- ClamAV detects it as Win.Trojan.GoDiscorder-10060526-0.
- A bootkit routine writes a placeholder file named bootkit.bin.
Impact: Credential, wallet and surveillance theft plus a fake lock screen
- 1.Watch for traffic to total-sitevv.lol and 87.120.196.120.
- 2.Look for the SystemLock Run key, lock_start.bat and lock_screen.html.
- 3.Rotate exposed AI API keys and review calls to api.openai.com.
- ATT&CK
- T1071.001 Web ProtocolsT1555.003 Credentials from Web BrowsersT1056.001 KeyloggingT1548.002 Bypass User Account ControlT1547.001 Registry Run Keys / Startup Folder
- Malware
- NIK C2
- Organizations
- Cisco TalosOpenAI
- AI models
- gpt-4
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | total-sitevv.lol | os saw a live server at 87.120.196[.]120, which resolved to total-sitevv[.]lol. Its certificate used the common name “nik-panel”. That c |
| ipv4 | 87.120.196.120 | nd a hardcoded fallback address. Talos saw a live server at 87.120.196[.]120, which resolved to total-sitevv[.]lol. Its certificate us |
From the original article
2 min read at gbhackers.com
Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client. Operators can send prompts through an infected machine and read the model’s replies in their C2 panel. NIK C2 malware According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured […]
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.