Cisco Talos has uncovered a new AI-powered command-and-control (C2) framework called NIK C2, which integrates advanced AI capabilities to enhance malicious operations. The framework includes a Windows implant that allows attackers to dump credentials, capture keystrokes, and analyze harvested data using an integrated AI model, all within a single compromised session. Notably, NIK C2 abuses OpenAI’s Chat Completions API, enabling ChatGPT-style interactions programmatically. This integration allows attackers to deploy desktop screen-locking ransomware, demanding ransom payments in Bitcoin or USDT cryptocurrencies.
The NIK C2 implant is a Go-based, 64-bit Windows remote access tool designed for persistent control over compromised hosts. It uses a dual-channel C2 architecture, communicating over TLS-secured WebSockets on port 443 with an HTTP fallback polling loop every 250 milliseconds. All traffic is encrypted with AES-256-GCM derived from a hardcoded seed. The implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, and process hollowing.
One of the most distinctive features of NIK C2 is its integration with OpenAI’s API. The implant constructs HTTP requests to OpenAI’s production inference endpoint, transmits them from the victim’s machine, and returns AI-generated text to the actor’s panel. The entire operation is executed synchronously with a 60-second timeout. The implant also includes a fallback mechanism that uses the victim’s OpenAI API key if the actor does not provide one, effectively billing the victim for the AI services used.
Cisco Talos observed that NIK C2 is actively being used in the wild, with a threat actor hosting the framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”. The C2 server hosted an SSL/TLS certificate with the Common Name (CN) set to nik-panel, matching strings embedded within the implant binary. This indicates that NIK C2 is not just a proof of concept but a fully functional, AI-integrated C2 framework.