Cisco Talos exposes NIK C2: Go-based Windows RAT that uses victims' OpenAI API keys and a screen-locking ransomware module

Linha do tempo

1. gbhackers.com ↗ · pub. 30/10/2026 06:45 · coletado 30/10 07:00

   Cisco Talos uncovers NIK C2, a Go-based Windows RAT with embedded OpenAI client and 52+ commands

   ler a análise desta fonte ocultar

   Cisco Talos has documented NIK C2, a Go-based 64-bit Windows remote access tool that embeds a functional OpenAI client, letting operators issue prompts from the infected host and read responses in their C2 panel. The implant communicates over TLS WebSockets on port 443 with an HTTP fallback polling every 250 ms, encrypting traffic with AES-256-GCM derived from a hardcoded seed, and uses three prioritized C2 tiers for takedown resilience. A live server at 87.120.196[.]120 resolving to total-sitevv[.]lol with a certificate CN of "nik-panel" led Talos to assess with moderate confidence that this is an operational framework rather than a PoC. Notably, the ai_generate command falls back to the victim's OPENAI_API_KEY environment variable, making the victim pay for inference and attributing OpenAI logs to the victim. The tool fits a growing pattern of LLM-enabled malware alongside MalTerminal and the x47.c botnet.

   Technical Details

   • Dispatcher supports more than 52 commands: browser credential, Discord token, Wi-Fi password, crypto wallet and seed-phrase theft; keylogging, screen capture, camera, audio and clipboard surveillance; hidden VNC, SOCKS5, reverse proxy and RDP for remote control and lateral movement.
   • Persistence via registry Run key (SystemLock) and a watchdog process.
   • Defense evasion: renames itself csrss.exe, marks itself a critical process so termination causes a BSOD, exits on debugger detection, UAC bypass via fodhelper.exe hijack, and AMSI patching in PowerShell.
   • Ransomware module backs up the MBR, builds an HTML lock screen demanding Bitcoin and USDT, launched via mshta.exe, with a batch loop reopening it within five seconds — no files are encrypted.
   • A bootkit-preparation routine checks UEFI/BIOS and Secure Boot state and writes a placeholder bootkit.bin.
   • Default model is gpt-4, calls go to the Chat Completions endpoint with a 60-second timeout.

   Remediation

   • Monitor for traffic to 87.120.196[.]120 / total-sitevv[.]lol, the SystemLock Run key, and lock_start.bat / lock_screen.html in temp directories.
   • Alert on unexpected outbound connections to api.openai.com from endpoints.
   • Rotate any exposed AI API keys.
   • ClamAV detects the threat as Win.Trojan.GoDiscorder-10060526-0.
2. infosecurity-magazine.com ↗ · pub. 29/10/2026 12:00 · coletado 29/10 13:01 primeiro registro

   Cisco Talos uncovers NIK C2 framework that hijacks victims' OpenAI API keys for in-session AI analysis

   ler a análise desta fonte ocultar

   Cisco Talos published research on October 29 detailing NIK C2, a Go-based command-and-control framework observed in the wild targeting Windows systems. The implant combines remote access, credential theft, keylogging and surveillance with an integrated OpenAI client that lets operators run AI prompts directly from the compromised host. When no operator key is supplied, the malware falls back to the victim's OPENAI_API_KEY environment variable, billing the AI usage to the victim and leaving OpenAI access logs pointing at the victim's key rather than the attacker. Talos also found a screen-locking ransomware module demanding Bitcoin or USDT. With at least three implant versions observed and live infrastructure, Talos assesses with moderate confidence that NIK C2 is a fully functional framework rather than a proof of concept.

   Technical Details

   • Go-based Windows implant supporting more than 52 commands: credential theft, browser data collection, cryptocurrency wallet theft, Wi-Fi credentials, keylogging, screen capture, remote access, lateral movement and multiple defense-evasion capabilities.
   • Operators select a prompt and model via the C2 panel; the implant issues the OpenAI request from the victim machine and returns the response, collapsing collection and exploitation into a single session.
   • Fallback to the victim's OPENAI_API_KEY environment variable is described by Talos as a deliberate design choice that obscures attribution and shifts cost to the victim.
   • The ransomware module only locks the screen and encrypts no files, avoiding file-modification timestamps or encryption markers and deploying far faster than file-encrypting ransomware.

   Remediation

   Audit hosts for OPENAI_API_KEY environment variables and avoid storing API keys in system-wide environment variables; monitor OpenAI billing and access logs for anomalous usage; hunt for unexpected outbound traffic to AI API endpoints from endpoints that should not make such calls.