Cisco Talos finds NIK C2 using OpenAI in live attacks

Cisco Talos researchers have uncovered an active threat framework named NIK C2 that integrates a live OpenAI API client directly into compromised Windows hosts. The 64-bit Go-based implant harvests credentials, streams keystrokes and implements screen-locking ransomware, with OpenAI model prompts processed from within the victim machine.

In late October 2026, researchers observed the framework operating on live server infrastructure, with the command server reachable at a public IP and the domain total-sitevv[.]lol resolving to it. The implant’s internal build path shows compilation with Go 1.23.4 on Linux, and samples carried zeroed PE timestamps to hinder timeline analysis; some files display simulated creation dates from November 1979.

NIK C2 evolved across three versions between 12–18 August 2026, beginning with credential theft and a reverse proxy (version 1), adding hidden desktop control and evasion modules (version 2), and culminating with integrated OpenAI models and desktop ransomware (version 3). Analysts note that the operators maintain the nik_panel project with suspected financial motives, prioritising cryptocurrency wallets, API quota theft, and screen-lock extortion; Broadcom Carbon Black corroborated active wild deployments.

The Windows NIK C2 implant checks launch flags, relaunches itself via a watchdog, hides its console window, and renames itself to csrss.exe or svchost.exe in the temp directory. It disables Recent Documents tracking, attempts to bypass UAC via fodhelper.exe, patches AMSI, and establishes autostart persistence. Communications rely on dual channels: a TLS WebSocket link on port 443 with certificate pinning and an HTTP polling loop every 250 milliseconds, with AES-256-GCM encryption and a hardcoded 32-byte seed.

On-device AI usage prompts the OpenAI Chat Completions API from the victim host, potentially incurring the victim’s API costs.