NIK C2: The new AI-enabled command-and-control framework

What happened?

Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP endpoint that enables ChatGPT-style conversations programmatically.

Key details

• NIK C2 is an AI-integrated C2 framework observed in the wild with a Windows implant.
• The implant uses OpenAI Chat Completions API to process actor prompts via victim machines.
• The implant routes traffic across three prioritized C2 tiers to survive takedowns.
• The implant embeds a fully integrated OpenAI API client via the ai_generate command.
• The implant uses a hardcoded seed to derive AES-256-GCM encryption for all C2 traffic.
• The implant can deploy screen-locking ransomware demanding Bitcoin or USDT.

Summarised by SecOraLens from Cisco Talos. Always read the original source before acting. How SecOraLens verifies advisories.