NIK C2

NIK C2 is an AI-integrated command-and-control framework with a Go-based remote access implant targeting 64-bit Windows systems. It supports more than 52 commands spanning credential theft, surveillance, remote desktop control, network pivoting, defense evasion, and screen-locking extortion. At least three implant versions have been identified.

The implant collects browser passwords, cookies, autofill information, saved Wi-Fi credentials, Discord tokens, and cryptocurrency wallet data. It searches for recovery phrases, private keys, and other secrets, and can exfiltrate encrypted browser databases for offline extraction. Surveillance features include live keystroke streaming, screen capture, clipboard interception and replacement, and hidden VNC desktop control. Proxy tunnels, TCP relaying, and RDP session hijacking support lateral movement.

An integrated OpenAI client lets operators submit prompts and harvested information for analysis from the compromised computer, returning generated responses and usage information through command-and-control channels. If the operator supplies no API key, the implant attempts to use a key stored in the victim's environment, potentially charging attacker-directed requests to the victim's account. This integration does not require autonomous AI control of the implant.

NIK C2 combines TLS-secured WebSockets with independent HTTP polling, AES-256-GCM message encryption, certificate pinning, and multiple fallback servers. Persistence mechanisms include Windows autostart entries and watchdog processes. Evasion capabilities include process masquerading, process hollowing, anti-debugging checks, AMSI bypass routines, and UAC bypass. It can also mark itself as a critical process, making termination capable of crashing Windows.

Its extortion module displays a persistent payment screen demanding Bitcoin or USDT without encrypting victim files. A separate bootkit-preparation function checks firmware and Secure Boot status but does not implement a functional bootkit. Initial delivery methods, specific victim industries, and threat-actor attribution have not been established.