Talos: NIK C2, a Go-based Windows C2 with a built-in OpenAI API client. Operators prompt OpenAI from the compromised host; the implant resolves keys and parses responses. Server: 87.120.196[.]120 #NIKC2 #OpenAI #ThreatIntel https://is.gd/5PzID0
October 31, 2026 at 9:32 AM
Talos: NIK C2, a Go-based Windows C2 with a built-in OpenAI API client. Operators prompt OpenAI from the compromised host; the implant resolves keys and parses responses. Server: 87.120.196[.]120 #NIKC2 #OpenAI #ThreatIntel https://is.gd/5PzID0
Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
At a Glance Malware Family NIK C2 framework (Go-based 64-bit Windows implant, OpenAI API client, and screen-locking ransomware) Threat Actor Unattributed operator group (internal project labeled nik_panel; intent unconfirmed) Target / Victims Windows endpoints holding cryptocurrency wallets, browser logins, and OpenAI developer keys (active server observed in the wild) Delivery Vector
securityonline.info
November 2, 2026 at 8:21 AM
Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec