MalwarePublished 29 Oct 2026

NIK C2: The new AI-enabled command-and-control framework

Source Cisco Talos

Description

NIK C2 is a newly observed AI-enabled command-and-control (C2) framework targeting Windows systems. It features a Go-based implant that provides persistent remote access with capabilities including credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and deployment of screen-locking ransomware demanding cryptocurrency payments. The implant uniquely integrates the OpenAI Chat Completions API, allowing threat actors to analyze harvested data using AI in real time within the compromised session. This integration collapses traditional offline data processing delays, complicating detection and response efforts. The implant communicates over encrypted channels with resilient fallback mechanisms and has been observed in multiple evolving versions compiled no earlier than late 2024. Active infrastructure associated with NIK C2 has been identified in the wild, confirming its operational status.

Impact

The NIK C2 framework enables threat actors to maintain persistent control over compromised Windows hosts, steal sensitive credentials and keystrokes, perform lateral movement, and deploy ransomware that locks the victim's desktop demanding cryptocurrency ransom. The integration of AI via the OpenAI API allows real-time analysis of stolen data within the compromised session, removing traditional detection windows and increasing the speed and sophistication of attacks. The abuse of victim API keys for AI queries also complicates attribution and increases operational stealth. This represents a significant escalation in adversary tradecraft by combining collection, analysis, and exploitation into a continuous, AI-enhanced operation.

Defensive guidance

Defenders should adopt continuous behavioral monitoring and vigilance beyond traditional detection methods to identify anomalous activity consistent with this framework. Network defenses should monitor for unusual TLS WebSocket traffic on port 443 and fallback HTTP polling patterns every 250 milliseconds. Credential dumping, RDP session hijacking, and process hollowing behaviors should be closely investigated. Organizations should also audit and secure any stored OpenAI API keys on endpoints to prevent abuse. Incident response should focus on identifying and removing the implant and associated infrastructure.

Summary

Cisco Talos discovered the NIK C2 framework, an AI-integrated Windows remote access tool written in Go. The implant uses a dual-channel TLS-encrypted C2 communication over WebSockets and HTTP polling, with AES-256-GCM encryption derived from a hardcoded seed. It supports credential dumping, keystroke streaming, lateral movement techniques such as RDP hijacking and process hollowing, and a ransomware module that locks the victim's screen demanding Bitcoin or USDT. A key innovation is the embedded OpenAI API client, enabling operators to send arbitrary prompts to the OpenAI Chat Completions API directly from the infected host. The implant manages API key resolution, potentially abusing victim-stored OpenAI API keys to fund AI queries, and supports dynamic selection of AI models including GPT-4. The implant's development shows rapid evolution with multiple versions compiled since late 2024, indicating a skilled threat actor expanding capabilities. Active C2 infrastructure was observed, confirming the framework's deployment in real-world attacks.

References

blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Oct 2026, 10:07 UTC

Technical details

References

Community reviews

Related threats