VULNpocalypse
HighEcosystem changeActive

NIK C2 framework: Windows implant uses victims’ OpenAI API keys for AI analysis

Cisco Talos found NIK C2, a Windows C2 framework whose implant calls OpenAI and can bill the victim’s own API key.

Published
Exploitation
Yes, Cisco Talos observed NIK C2 and an active C2 server in the wild

What happened

Cisco Talos published research on 29 October 2026 describing “NIK C2”, a new AI-integrated command-and-control framework seen in the wild (Cisco Talos). Infosecurity Magazine reported the same findings the same day (Infosecurity Magazine).

Key facts from Talos:

  • Implant: a Go-based, 64-bit Windows remote access tool. It uses TLS WebSockets on port 443, with an HTTP fallback polling loop every 250 milliseconds. Traffic is protected with AES-256-GCM derived from a hardcoded seed. It uses three prioritized C2 tiers: runtime-updated URLs, an embedded encrypted server list, and a hardcoded fallback address (Cisco Talos).
  • Capabilities: over 52 commands, including credential dumping, keylogging, RDP session hijacking, process hollowing, lateral movement and evasion. It also has a C2-driven screen-lock ransomware module that demands Bitcoin or USDT (Cisco Talos). Infosecurity Magazine adds that the module encrypted no files, leaving no file-modification or encryption artifacts (Infosecurity Magazine).
  • AI abuse: the ai_generate command lets operators send a prompt to the OpenAI Chat Completions API (https://api.openai.com/v1/chat/completions) from the infected host. The default model is gpt-4, and the operator can override it. The result goes back to the C2 over an encrypted channel, with a 60-second timeout (Cisco Talos).
  • Key fallback: if the operator supplies no api_key, the implant reads the OPENAI_API_KEY environment variable on the victim machine. Talos called this a deliberate design: OpenAI would bill the victim’s payment method, and access logs would show the victim’s key, leaving no trace attributable to the actor (Cisco Talos).
  • Maturity: at least three implant versions, all compiled with Go 1.23.4. An active server was seen, so Talos assesses with moderate confidence that NIK C2 is a functional framework and not a proof of concept (Cisco Talos).

Initial access vector, victim count and threat actor attribution are not confirmed in the provided sources. The Talos text available to us was truncated, so the full command table is not confirmed.

Am I affected?

You may be affected if any of these apply:

  • Windows hosts where an OpenAI API key is set in the OPENAI_API_KEY environment variable (developer workstations, build agents, AI tooling hosts). These carry extra risk of billing abuse.
  • Any host showing the indicators below.

Indicators reported by Talos (Cisco Talos):

  • C2 IP 87.120.196[.]120 and domain total-sitevv[.]lol.
  • TLS certificate with Common Name nik-panel, serial number 7d16381a9de823943b5a0987dbd0f26edf22052b.
  • JARM: 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b.
  • Embedded build path /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go, and the log string [NIK] Starting.
  • Process masquerading as svchost.exe or simvol.exe. Copies placed in %appdata%/Roaming/Microsoft/Network, plus Windows autostart registry entries. Watchdog and copywatchdog command-line arguments.
  • Zeroed PE TimeDateStamp fields and filesystem timestamps near the epoch (Nov 29, 1979).

What to do now

  1. Block and alert on the IP, domain and certificate indicators above, and search historical DNS, proxy and TLS logs for them.
  2. Hunt endpoints for the persistence and masquerade artifacts: files in %appdata%/Roaming/Microsoft/Network, new autostart registry entries, and svchost.exe or simvol.exe running from unexpected paths.
  3. Flag unusual outbound calls to api.openai.com from hosts that should not use it, especially from non-developer machines or non-standard processes.
  4. Rotate any OpenAI API key present on a suspect host, and review OpenAI usage and billing for requests you did not make. Note that logs will show your key as the caller.
  5. Treat suspect hosts as fully compromised: reset credentials that could have been dumped or keylogged, including browser, Wi-Fi and cryptocurrency wallet secrets, and check for lateral movement and RDP session hijacking.
  6. Avoid keeping long-lived API keys in plain environment variables on general-purpose Windows endpoints, and use scoped keys with spending limits.
  7. Prepare for screen-lock extortion: it encrypts no files, so recovery focuses on reimaging and credential hygiene, not decryption. Do not rely on file-modification timestamps for detection (Infosecurity Magazine).
  8. Prioritize behavioral detection. Talos says AI-enabled frameworks collapse collection and exploitation into one session, removing the offline processing delay that gave defenders time to detect (Cisco Talos).

No CVE or patch applies. This is malware, not a software vulnerability.

Sources