NIK C2: The new AI-enabled command-and-control framework

Cisco Talos identified a new AI-integrated command-and-control (C2) framework named NIK C2, which enables threat actors to conduct credential theft, keystroke logging, ransomware deployment, and AI-driven data analysis directly from compromised hosts. The malware, written in Go, uses a dual-channel C2 architecture over TLS-secured WebSockets and HTTP polling, with traffic encrypted via AES-256-GCM. A key feature is its integration with OpenAI's API, allowing attackers to route prompts through victim machines using either their own or the victim's API key, thereby obscuring attribution and shifting costs to the victim. The framework supports over 52 commands, including screen-locking ransomware, lateral movement, and bootkit preparation, and has been observed in active infrastructure, confirming it as a functional threat.

AI-extracted · verify before operational use