NIK C2: The new AI-enabled command-and-control framework

NIK C2 is an advanced AI-enabled command-and-control framework targeting Windows systems. It features a Go-based implant capable of credential dumping, keystroke streaming, and real-time AI-powered data analysis via the OpenAI Chat Completions API. The framework uses a dual-channel C2 architecture with TLS-secured WebSockets and HTTP fallback, employing AES-256-GCM encryption. It includes surveillance, lateral movement, screen-locking ransomware demanding cryptocurrency payments, and bootkit preparation. The implant employs advanced defense evasion techniques such as AMSI patching, process hollowing, and anti-debugging. Active infrastructure has been observed, confirming operational deployment beyond proof-of-concept. The framework is under active development with multiple versions compiled using Go 1.23.4.

• Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in AsiaMalware2026-10-29
• Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File InflationMalware2026-07-07
• From Phishing to Persistence: A CrySome RAT Infection Chain AnalysisMalware2026-07-07
• Inside DesckVB Rat Analysis: From Malspam to In-Memory RATMalware2026-06-03
• OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSIONCampaign2026-05-10