Cisco Talos identifies AI-enabled NIK C2 framework in active attacks

Cisco Talos identified NIK C2, an AI-integrated command-and-control framework in active attacks, residing on a server at IP address 87.120.196[.]120 under the domain total-sitevv[.]lol.

Cisco Talos says the framework centers on a Windows-based implant that provides persistent remote control of 64-bit systems. A command-and-control framework is the infrastructure attackers use to control compromised machines. Written in the Go programming language, the implant opens a TLS-protected WebSocket channel on port 443 and falls back to HTTP polling every 250 milliseconds. All communications are encrypted with AES-256-GCM using a hardcoded seed value.

Cisco Talos says operators can route the implant through three prioritized command-and-control routing tiers meant to survive infrastructure takedowns. The implant tries runtime-updated URLs first, then an embedded encrypted server list, and finally a hardcoded fallback address for traffic. The embedded build path in observed samples reads /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go, tying the project to nik_panel. The binaries were compiled on a Linux system for Windows targets, and its SSL/TLS certificate bears the serial number 7d16381a9de823943b5a0987dbd0f26edf22052b with nik-panel as its Common Name.

Cisco Talos counted at least three separate versions in the implant’s development trajectory. All samples recovered from the wild were compiled with Go version 1.23.4. The Go 1.23.4 release dates to December 2024, and none of the samples were compiled before late 2024. All samples carry near-epoch filesystem timestamps that read Nov 29, 1979.

Cisco Talos says the implant grants operators credential dumping, keystroke streaming, and RDP session hijacking. A background goroutine (a lightweight Go thread) that runs persistently checks all 256 Windows virtual key codes, and each keypress goes out immediately as an encrypted JSON packet over WebSocket to the command-and-control server. The implant keeps an in-memory keystroke buffer capped at 10,000 entries, cutting it in half when it fills.

According to Cisco Talos, the archive includes browser databases and the Local State file that holds the AES master key protected by DPAPI. Discord authentication tokens and browser session cookies come from the levelDB store. Two case-insensitive regular expressions sweep the filesystem for cryptographic assets and credentials. Matched items receive the label seed candidates, and the implant archives them into browserdata.zip.

Cisco Talos says the implant targets Exodus at /AppData/Roaming/Exodus/exodus.wallet. It also targets Electrum at /AppData/Roaming/Electrum/wallets and Bitcoin Core at wallet.dat.

According to Cisco Talos, the implant also supports process hollowing and a command-and-control-driven screen-locking ransomware module. The module works as a multi-stage attack controller for preparing, deploying, and retracting a screen-locking payload. It first runs PowerShell to copy the Master Boot Record from \\.\PhysicalDrive0 to mbr_backup.bin in the Windows temporary directory.

Cisco Talos says a hardcoded format string shapes the lock screen code using actor-supplied values such as cryptocurrency addresses, pricing, contact e-mail, timer length, and custom text. The binary writes the HTML code to lock_screen.html in the system temporary directory, then creates a batch script that runs mshta.exe on the HTML file with an infinite loop and a five-second delay between iterations. The implant adds a SystemLock Run key to the current user autostart path that launches the batch file.

According to Cisco Talos, since no file encryption occurs, the attack leaves no forensic trail of changed timestamps or encryption artifacts. The ransomware demands payment in Bitcoin or USDT cryptocurrencies.

Cisco Talos says operators can direct an embedded artificial intelligence model to examine stolen data in the middle of an active session. The implant abuses the OpenAI Chat Completions API, which provides an HTTP interface for programmatic ChatGPT-style conversations. The ai_generate command gives the implant a complete OpenAI API client.

According to Cisco Talos, through a compromised machine, operators can send prompts straight to OpenAI’s conversational API. On the implant itself, local processing handles API keys, builds requests, and parses responses. Encrypted AI output travels back to the operator’s command-and-control infrastructure.

Cisco Talos says a command payload carries three items: the prompt text, an API key, and a model name. If the actor supplies no key, the implant pulls OPENAI_API_KEY from the system environment and uses the victim’s key instead. A victim who has an OpenAI account on the machine pays for the operator’s AI inference through that account’s key without knowing it.

According to Cisco Talos, OpenAI’s billing system charges the victim’s payment method. OpenAI’s access logs log the victim’s key as the request source, which conceals the actor. When no model is specified, the implant falls back on a five-character default value held in its binary data section. Analysis of that five-character string shows gpt-4 as the default model if the actor omits one.

Cisco Talos says the actor can replace the default with any valid OpenAI model identifier in the command payload. The implant executes netsh commands through Go’s exec.Command with discrete argument tokens instead of a shell string.

According to Cisco Talos, the tool combines data gathering and exploitation in a single ongoing session, which removes offline processing delays that once gave defenders detection opportunities. Cisco Talos holds moderate confidence that the framework is a fully functional, AI-integrated tool rather than merely a proof of concept. Cisco Talos says defenders confronting AI-enabled adversarial frameworks should move beyond conventional detection and adopt continuous behavioral vigilance as the standard baseline.