Summary Points
- NIK C2 is an active AI-integrated Windows RAT that can analyze stolen data through OpenAI’s API during the compromised session—and may bill the victim’s API account.
- Its 52+ commands enable extensive theft and intrusion: credentials, keystrokes, browser sessions, crypto wallets and Wi‑Fi passwords, plus stealth, persistence and lateral movement.
- It can deploy persistent screen-locking ransomware with customizable Bitcoin or USDT demands; it locks users out without encrypting files.
1. Threat, Techniques, and Targets
- Cisco Talos observed NIK C2, an AI enabled command and control framework with a 64 bit Windows implant.
- The implant steals credentials, browser data, Wi Fi passwords, session tokens, and cryptocurrency wallet information. It also records keystrokes and captures screen, camera, and microphone activity.
- In addition, operators can use the implant to run AI prompts through the OpenAI Chat Completions API, hijack RDP sessions, and route traffic into internal networks.
- NIK C2 uses TLS WebSockets on port 443 and a separate HTTP polling channel. It also uses persistence, process masquerading, process hollowing, and evasion techniques.
- The implant can deploy screen lock ransomware that demands Bitcoin or USDT. It can also prepare a bootkit payload.
- Talos observed an active C2 server at 87.120.196[.]120, linked to total-sitevv[.]lol. The report identifies Windows hosts and their users as targets, but does not name specific industries.
2. Impact, Security Implications, and Remediation
- NIK C2 can expose credentials, private data, and digital assets. It can also disrupt access to a device with a persistent screen lock.
- Moreover, its continuous data collection and AI processing can reduce the time defenders have to detect and respond. If a victim machine holds an OpenAI API key, the implant may use it and charge the victim’s account.
- Talos recommends continuous behavioral vigilance. It also reports that the ClamAV signature Win.Trojan.GoDiscorder-10060526-0 detects and blocks this threat.
- Organizations should review relevant activity and indicators, including the reported C2 server and domain. For further remediation steps, obtain guidance from the relevant security vendor or authority.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
