NIK C2: Talos documents a Go Windows implant that sends operator prompts to the OpenAI API from the infected host and falls back to the victim's own API key

Cisco Talos found a command-and-control framework it calls NIK C2, with a live server, whose 64-bit Go implant for Windows takes more than 52 commands: browser and Wi-Fi credential theft, keylogging, screen, camera, microphone and clipboard capture, hidden VNC, RDP session interaction, an embedded SOCKS5 and HTTP proxy with a reverse tunnel for lateral movement, AMSI patching, UAC bypass and process hollowing (Cisco Talos, 2026-10-29). It talks to its server over TLS WebSockets on port 443 with an HTTP polling fallback about every 250 milliseconds under AES-256-GCM, persists through registry Run keys and COM hijacking, masquerades under a system-process name such as svchost.exe and runs a watchdog process (Cisco Talos, 2026-10-29). The new part is the ai_generate command: the implant builds an OpenAI Chat Completions request from an operator prompt on the infected host, posts it to OpenAI from the victim's address and returns the answer to the panel; if the operator gives no key it reads the OPENAI_API_KEY environment variable, so OpenAI charges the victim's payment method and its logs show the victim's key (Cisco Talos, 2026-10-29; Infosecurity Magazine, 2026-10-29). A screen-locking ransomware module encrypts no files: PowerShell copies the boot sector to a temporary file, and a looping batch file reopens a lock page shown through mshta.exe (Cisco Talos, 2026-10-29). Talos sees at least three implant versions and assesses with moderate confidence that the framework is functional; its post names no victims, sector or delivery method (Cisco Talos, 2026-10-29).