NIK C2 Combines AI API Access With Windows Intrusions and Screen-Locking Ransomware

Cisco Talos identified NIK C2, an operational, AI-integrated command-and-control framework whose Go-based Windows implant supports credential theft, surveillance, lateral movement, and persistent remote access. Its ai_generate command sends operator-supplied prompts to the OpenAI Chat Completions API from compromised hosts. When operators do not provide an API key, the implant can use the victim’s OPENAI_API_KEY environment variable, potentially consuming the victim’s API resources. Communications combine TLS WebSockets with independent HTTP polling, encrypted messages, and multiple fallback servers to maintain connectivity.

The framework also deploys persistent screen-locking ransomware demanding Bitcoin or USDT, but it does not encrypt files. A separate bootkit-preparation function stages only a placeholder, not a functioning bootkit. Talos identified active infrastructure at 87.120.196[.]120 associated with total-sitevv[.]lol and assessed with moderate confidence that NIK C2 is a functional framework rather than merely a proof of concept. Defenders should investigate connections to these indicators, unexpected OpenAI API activity from Windows endpoints, and anomalous use of locally stored API credentials.