NIK C2 Malware Brings Its Own ChatGPT, Billed to the Victim

Cisco Talos has pulled apart a new Windows remote-access kit called NIK C2 that comes with its own ChatGPT client built in. In a write-up by Chetan Raghuprasad, Talos says the Go implant packs more than 52 commands: password and crypto-wallet theft, a keylogger, webcam and microphone capture, a hidden desktop, proxying, a screen-locking ransom page and early bootkit groundwork. The operator can also send prompts to OpenAI from the infected machine, and if no API key is supplied the implant quietly uses the victim’s own OPENAI_API_KEY, so the victim pays for the attacker’s queries.

total-sitevv[.]lol
87.120.196[.]120
2.26.51[.]12 (port 4443)
TLS CN: nik-panel
TLS serial: 7d16381a9de823943b5a0987dbd0f26edf22052b
JARM: 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b
Paths: /api/c2/update, /api/c2/result, /api/c2/screen, /api/c2/file_chunk, /api/c2/rproxy_up, /api/c2/ws

%TEMP%\csrss.exe
%AppData%\Roaming\Microsoft\Network\ (implant copy)
HKCU Run value: SystemLock
HKCU\Software\Classes\ms-settings\Shell\Open\command (short-lived)
mbr_backup.bin, lock_screen.html, lock_start.bat, bootkit.bin, browserdata.zip
Strings: [NIK] Starting, NIK_BOOTKIT_PREP

Source article: NIK C2: The new AI-enabled command-and-control framework
Publisher: Cisco Talos (Chetan Raghuprasad)
Published: October 29, 2026
URL: https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/

Executive Summary

Cisco Talos documents NIK C2, a previously unreported Windows remote-access framework consisting of a 64-bit Go implant (Go 1.23.4, cross-compiled from Linux, PE TimeDateStamp fields zeroed, file times set to November 1979) and a web panel whose TLS certificate carries the common name nik-panel; Talos assesses with moderate confidence that it is a functional framework from technically proficient developers with prior malware experience, and names no threat actor, victims, sectors or initial access vector. After execution the implant hides its console, renames itself csrss.exe in the Windows temp folder, enforces a single instance with a mutex, adopts a svchost.exe or simvol.exe masquerade name, copies itself to %AppData%\Roaming\Microsoft\Network with altered ACLs, sets Run-key autostart, launches a watchdog that restarts it, flags itself as a critical process (ProcessBreakOnTermination) so termination causes a bugcheck, exits on debugger detection, elevates through a fodhelper.exe ms-settings COM hijack whose key it deletes within about two seconds, and patches AMSI. It registers to C2 over a certificate-pinned TLS WebSocket on port 443, with roughly 250 ms HTTP polling and three tiers of failover servers, sending AES-256-GCM payloads wrapped in JSON beside an ag_-prefixed agent ID to /api/c2/ endpoints. Its 52-plus commands cover browser, Wi-Fi, Discord and crypto-wallet theft, keylogging, screenshots, camera and microphone capture, clipboard monitoring and replacement, hidden VNC, SOCKS5/HTTP proxying and reverse tunnels, process hollowing, a screen-locking ransom page launched through mshta.exe with an MBR backup, and bootkit preparation that fingerprints UEFI and Secure Boot; an embedded OpenAI client relays operator prompts to the chat completions API, falling back to the victim’s OPENAI_API_KEY so the victim is billed. The objective is broad data theft and remote control with an extortion option; impact on an infected host is effectively total credential and session compromise. Hunt leads, false positive expectations, the published ClamAV signature name and indicators are detailed below; Talos publishes no YARA or Sigma rules.

ATT&CK chain: Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Collection → Command and Control → Impact

Hunt Lead Grid

NIK C2 Infrastructure, TLS and Endpoint Sweep

Talos identifies the NIK C2 panel on 87.120.196[.]120, reached through the domain total-sitevv[.]lol, and its IOC repository adds 2.26.51[.]12 with the URL hxxps://2.26.51[.]12:4443/api/c2/update. The panel’s TLS certificate has serial 7d16381a9de823943b5a0987dbd0f26edf22052b and common name nik-panel, and the server’s JARM fingerprint is 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b. The implant opens a persistent WebSocket over TLS on 443 (port 443 is appended when none is configured) to /api/c2/ws and falls back to HTTP POSTs about every 250 ms to /api/c2/update, /api/c2/result, /api/c2/screen, /api/c2/file_chunk and /api/c2/rproxy_up, each body being JSON with an e field of Base64 AES-GCM data and a plaintext agent ID of the form ag_ followed by 16 hex characters. The detection logic is a retrospective match of the domain and both IPs in DNS, proxy, firewall and NetFlow logs; a match of the certificate serial, the nik-panel subject or the JARM value in TLS inspection or certificate-transparency monitoring; and, where TLS is decrypted, any request to the /api/c2/ paths carrying an ag_-shaped ID.

Sweep at least 90 days, since Talos gives no start date for the activity and the implant persists across reboots. The certificate subject and JARM value are the most durable pivots: they can also find new panel servers in internet-scan data before they touch your network, while the IPs will rotate (the implant has three tiers of failover servers, including runtime-updated URLs). Don’t alert on the /api/c2/ path strings by themselves, as other software and red-team frameworks use similar naming; require the ag_ ID, the infrastructure or the 250 ms cadence. Because the C2 channel pins its certificate, TLS interception will typically break the session, and a sudden pattern of failed handshakes from one host to an odd destination is itself worth checking. Any confirmed connection means a live implant: isolate the host and treat every credential, session cookie and wallet on it as stolen.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols), T1573.001 (Encrypted Channel: Symmetric Cryptography)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article); Cisco Talos IOCs, nik-c2-new-ai-enabled-framework.txt, Oct. 2026, https://github.com/Cisco-Talos/IOCs/tree/main/2026/10 (source article’s published IOC file)

NIK C2 Sample and Dropped-File Sweep

Talos’s IOC file lists eight SHA-256 values for NIK C2 implant builds, and Talos ships ClamAV coverage as Win.Trojan.GoDiscorder-10060526-0. The implant also leaves a recognizable set of files: a copy of itself as csrss.exe in the Windows temp folder and another under %AppData%\Roaming\Microsoft\Network, a PID file in a temp application folder, and module output in the temp folder, including mbr_backup.bin (a raw copy of the first sector of \\.\PhysicalDrive0), lock_screen.html and lock_start.bat (the ransom screen and its launcher), a 16-byte bootkit.bin containing the string NIK_BOOTKIT_PREP, and browserdata.zip (stolen browser data and wallet search results). The detection logic is a retrospective match of the eight hashes (and the MD5/SHA-1 equivalents in the appendix) in EDR and gateway telemetry, plus a file-creation search for those names under %TEMP% and for any executable written to %AppData%\Roaming\Microsoft\Network, and a ClamAV scan where it is deployed.

Sweep 90 days of EDR file events and run the hash list through any historical file inventory. The Go builds are cheap to regenerate (Talos found a per-build identifier in the panel’s build path, /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go), so hashes will miss new builds; treat a hash hit as confirmation and a miss as uninformative. The file names are the more durable signal: bootkit.bin and lock_start.bat in a user’s temp folder have no legitimate explanation, while browserdata.zip on its own is too generic and should only count next to another artifact. The decoded AES seed and key Talos published can decrypt captured C2 traffic during an investigation, which is useful for scoping what was taken. Any hit is an incident, not a tuning exercise.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location); Impact → T1491.001 (Defacement: Internal Defacement)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article); Cisco Talos IOCs, nik-c2-new-ai-enabled-framework.txt, Oct. 2026, https://github.com/Cisco-Talos/IOCs/tree/main/2026/10 (source article’s published IOC file)

System Process Names Running From Temp or AppData

On first run NIK C2 renames itself csrss.exe in the Windows temp directory, sets a masquerade name of svchost.exe or simvol.exe, copies itself to %AppData%\Roaming\Microsoft\Network with modified access controls, and writes a Run-key autostart entry so it returns at logon; a watchdog child started with the argument watchdog relaunches the core if it dies, and a copywatchdog argument handles file copies. The detection logic is a process-creation and registry rule: any process whose image name is csrss.exe, svchost.exe or simvol.exe and whose path is not %SystemRoot%\System32 or SysWOW64, any HKCU or HKLM Run value pointing into %TEMP% or %AppData%\Roaming\Microsoft\Network, and any such binary launched with a bare watchdog or copywatchdog argument.

Use EDR process telemetry (image path, command line, parent, signature) and registry events, or Sysmon Event IDs 1 and 13. Sweep 90 days. This is high-fidelity: real csrss.exe is started by smss.exe and real svchost.exe by services.exe, both signed by Microsoft, so allowlist by path and signer, never by name. Watch for the critical-process flag Talos describes (NtSetInformationProcess with ProcessBreakOnTermination): killing the process from Task Manager or taskkill will crash the machine, so responders should isolate the host and remove persistence offline or from a recovery environment rather than kill the process live. Hash-blocking csrss.exe would be the wrong control, since the name is borrowed, not the file. The rule generalizes to most commodity malware that hides behind system process names.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article)

Short-Lived ms-settings Hijack Before fodhelper

To gain elevated rights without a UAC prompt, NIK C2 writes its own command under HKCU\Software\Classes\ms-settings\Shell\Open\command, launches the auto-elevating fodhelper.exe, which reads that key and runs the attacker’s command at high integrity, then deletes the key within about two seconds to hide the change. It follows this by patching AmsiInitFailed in System.Management.Automation.dll with a six-byte stub so PowerShell content isn’t scanned. The detection logic is a registry and process sequence on one host: creation of any value under HKCU\Software\Classes\ms-settings\Shell\Open\command (including a DelegateExecute value), fodhelper.exe starting within seconds, a high-integrity child of fodhelper.exe that isn’t a Settings component, and deletion of the same key shortly after.

Use EDR registry and process telemetry, or Sysmon Event IDs 12, 13 and 1. Because the key exists for only a couple of seconds, a scheduled registry scan will miss it; you need event-based capture of the creation and deletion. Sweep 90 days. False positives are rare, since normal software never writes this key, so alert on the creation alone and raise severity when fodhelper.exe follows. Removing local admin rights from users and setting UAC to “Always notify” blunts this whole class of bypass, which is the better control than chasing individual binaries. This lead catches many malware families and red-team tools that use the same fodhelper trick, not just NIK C2. Treat a confirmed sequence as an active intrusion.

Hunt Lead Level: 2 (Pro)

ATT&CK: Privilege Escalation → T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control); Defense Evasion → T1112 (Modify Registry)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article)

Raw Disk Read, Boot Recon and Mshta Lock Loop

NIK C2’s destructive modules leave a distinctive sequence. The ransom module reads the first sector of \\.\PhysicalDrive0 through PowerShell into mbr_backup.bin in the temp folder, writes lock_screen.html (with operator-supplied BTC and USDT addresses, price, contact email and countdown) and lock_start.bat, which runs mshta.exe on the HTML in a loop with a five-second retry, adds a SystemLock value to the current user’s Run key, and keeps a goroutine relaunching the lock screen; no files are encrypted. The bootkit module runs bcdedit /enum and searches the output for EFI, Windows Boot Manager, Windows Legacy OS Loader or ntldr to classify UEFI versus BIOS, runs Confirm-SecureBootUEFI, and writes the 16-byte placeholder bootkit.bin. The detection logic correlates, per host and within a short window, PowerShell opening \\.\PhysicalDrive0 for raw read, bcdedit /enum and Confirm-SecureBootUEFI spawned by the same non-administrative parent, cmd.exe running a .bat from %TEMP% that repeatedly launches mshta.exe against a local .html file, and a new SystemLock Run value.

Combine EDR process lineage, PowerShell script block logging (Event ID 4104) and registry events. Raw disk access, bcdedit and Secure Boot checks are all things admins, imaging and inventory tools do, so scope by parent: allowlist your deployment, backup and management agents by signed image path and alert when an unsigned binary in a user-writable folder is the common ancestor. Note that file-modification or canary-file ransomware detections won’t fire here, because nothing is encrypted; the mshta loop and the Run value are the reliable signals. The bootkit stage Talos saw is preparation only, but the reconnaissance itself is worth alerting on, since few user processes ever ask whether Secure Boot is on. A hit means the operator is moving to extortion or deeper persistence: escalate immediately, isolate, and preserve the MBR backup and lock files for evidence.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1059.001 (Command and Scripting Interpreter: PowerShell); Discovery → T1082 (System Information Discovery); Defense Evasion → T1218.005 (System Binary Proxy Execution: Mshta); Impact → T1491.001 (Defacement: Internal Defacement) (our mapping for the ransom lock screen; the source gives no ATT&CK IDs)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article)

Non-Browser Process Calling the OpenAI API

NIK C2’s ai_generate handler takes a prompt from the operator, builds a request to hxxps://api.openai[.]com/v1/chat/completions with a short hardcoded system message and the operator’s text, defaults to the gpt-4 model unless told otherwise, waits synchronously for up to 60 seconds and returns the answer and token usage to C2. When the operator supplies no key, the implant reads the victim’s OPENAI_API_KEY environment variable, so requests are billed to and logged under the victim’s account. The detection logic correlates three things on one host: an outbound HTTPS connection or DNS lookup for api.openai[.]com from a process that isn’t on the approved list of AI clients, that process being an unsigned Go binary running from %TEMP% or %AppData%, and the same process holding a long-lived TLS session or rapid HTTP polling to non-OpenAI infrastructure; on the account side, OpenAI usage under an organization key from an unexpected IP or at odd hours.

Use EDR network events with process attribution, proxy or DNS logs, and the OpenAI organization usage dashboard. Build the baseline first: list which signed applications (IDEs, AI desktop apps, approved scripts) legitimately call api.openai[.]com and allowlist them by image path and signer, not process name. Blocking api.openai[.]com outright is usually the wrong control where developers rely on it; instead, keep API keys out of plain environment variables on endpoints, set spend limits and usage alerts, and scope keys per project so misuse stands out. Sweep 30 to 90 days of proxy data. This lead generalizes to any malware that borrows AI services, a pattern likely to grow. A confirmed hit means both an implant on the host and a compromised API key: rotate the key, review its usage logs and handle the host as infected.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); Impact → T1496.004 (Resource Hijacking: Cloud Service Hijacking) (our mapping for use of the victim’s OpenAI key; the source gives no ATT&CK IDs)

Sources: “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos, Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article)

Hash Appendix

NIK C2 implant builds

SHA-256 values come from the IOC file Talos published with the source article (no file names given). MD5 and SHA-1 values were sourced via OTX AlienVault for seven of the eight; the OTX record for sample 3 lists several embedded files and no single unambiguous MD5/SHA-1, so those are marked not available.

MD5s
9f5a583005c1da5e2f605b52862e5175  # NIK C2 sample 1 -> Go implant build (sourced via OTX)
bf141ab8a32a90e0325028abe655990c  # NIK C2 sample 2 -> Go implant build (sourced via OTX)
(not available)  # NIK C2 sample 3 -> Go implant build
b625e355866b978149d7e9afae948b07  # NIK C2 sample 4 -> Go implant build (sourced via OTX)
b20843766659b1e951a3f7dbc3828664  # NIK C2 sample 5 -> Go implant build (sourced via OTX)
fc901d0458771ff20d02a13d44cd7ad2  # NIK C2 sample 6 -> Go implant build (sourced via OTX)
c8253d988eb4d9b9c7280772247f72b4  # NIK C2 sample 7 -> Go implant build (sourced via OTX)
6923b97b2a1e695b73b785ec30580cc0  # NIK C2 sample 8 -> Go implant build (sourced via OTX)

SHA1s
e5c90b0b73a5e173b526a65dd0dbd4a37e42d2a4  # NIK C2 sample 1 -> Go implant build (sourced via OTX)
a4226b4c78a31da7eb9687455c491c73b7721a54  # NIK C2 sample 2 -> Go implant build (sourced via OTX)
(not available)  # NIK C2 sample 3 -> Go implant build
51b03066b38ef87e254b545b34c1195d24a1c92b  # NIK C2 sample 4 -> Go implant build (sourced via OTX)
00f3e137d6783c201eab1a367235f7253d55f2a9  # NIK C2 sample 5 -> Go implant build (sourced via OTX)
653d00b028c37ce5644b4473ec617cfbe4dfbdb1  # NIK C2 sample 6 -> Go implant build (sourced via OTX)
bff0dcfe41187f7ec653beaed8616de0ba8ab36b  # NIK C2 sample 7 -> Go implant build (sourced via OTX)
4dbe654f0d3be5fae6ac3c1e45969fc1132a801f  # NIK C2 sample 8 -> Go implant build (sourced via OTX)

SHA256s
ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c  # NIK C2 sample 1 -> Go implant build
6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5  # NIK C2 sample 2 -> Go implant build
30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba  # NIK C2 sample 3 -> Go implant build
1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a  # NIK C2 sample 4 -> Go implant build
bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402  # NIK C2 sample 5 -> Go implant build
99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00  # NIK C2 sample 6 -> Go implant build
5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1  # NIK C2 sample 7 -> Go implant build
2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9  # NIK C2 sample 8 -> Go implant build

Other fingerprints (not file hashes): TLS certificate serial 7d16381a9de823943b5a0987dbd0f26edf22052b (nik-panel certificate); JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b (C2 server TLS fingerprint).

References Appendix

• “NIK C2: The new AI-enabled command-and-control framework”, Cisco Talos (Chetan Raghuprasad), Oct. 29, 2026, https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ (source article; implant behavior, C2 protocol, infrastructure, file artifacts, ClamAV signature name)
• Cisco Talos IOCs, nik-c2-new-ai-enabled-framework.txt, Cisco Talos, Oct. 2026, https://github.com/Cisco-Talos/IOCs/tree/main/2026/10 (SHA-256 values, 2.26.51[.]12 infrastructure)
• OTX AlienVault file indicator records for the eight SHA-256 values, AlienVault, accessed Oct. 31, 2026, https://otx.alienvault.com/ (MD5 and SHA-1 values)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/