Cisco Talos has uncovered NIK C2, an active command-and-control tool that merges Windows malware with direct access to OpenAI’s API This article explores locking ransomware integrating. . This framework enables attackers to steal credentials, monitor their targets, and submit collected data for AI analysis without leaving the compromised session.
Its Windows implant supports credential dumping, live keystroke collection, remote control, and screen-locking ransomware. By integrating these functionalities with AI, the time between information theft and AI analysis is minimized, reducing the window for defenders to intervene.
The TLS certificate associated with the Nik-panel framework matches strings found within malware, suggesting operational status rather than a proof of concept. The Nik panel utilizes an AI command, ai_generate, which accepts an attacker's prompt, API key, and model name. The handler uses a 60-second timeout, returning generated text, the selected model, and token usage details.
Written in Go for 64-bit Windows, NIK C2 maintains a TLS-protected WebSocket connection alongside an independent HTTP polling channel that runs approximately every 250 milliseconds. Its command interface supports more than 52 commands, including browser passwords, cookies, Discord tokens, cryptocurrency wallets, screenshots, microphone recording, and remote desktop interaction. Unlike ransomware that encrypts files, this module blocks desktop access without encrypting documents.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
