More than 52 commands — and an ability to bill AI queries to the victim whose machine the malware compromises.
Cisco Talos observed a Go-based implant on October 29
Cisco Talos published research on October 29 describing a new command-and-control framework it names NIK C2. Talos observed the implant in the wild and said the framework is Go-based. The company found the infrastructure active during its research and observed at least three versions of the implant, leading it to assess with moderate confidence that NIK C2 is a fully functional framework rather than a proof of concept.
How NIK C2 routes OpenAI requests through victims’ machines
The implant contains an integrated OpenAI client that lets attackers send stolen data for AI analysis within the compromised session, Cisco Talos reported. From the attacker’s control panel, operators can supply a prompt and model choice; the implant then sends that request to OpenAI from the infected host and returns the response to the operator.
Crucially, Talos said the AI capability is built into the implant rather than relying on an operator to process collected information separately. If an operator supplies no API key, the malware deliberately looks for an OPENAI_API_KEY environment variable on the compromised Windows machine. Talos described this as "a deliberate design": an organization with an OpenAI API key configured on a compromised system could therefore end up funding the attacker’s AI requests.
Talos also noted the practical consequence for forensic and billing trails: OpenAI’s billing system would charge the victim’s payment method and OpenAI’s access logs would show the victim’s key as making the requests, "leaving no trace attributable to the attacker," the company said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe implant’s full capability set and the ransomware module
Beyond AI integration, Talos said NIK C2 supports more than 52 commands spanning data theft and remote surveillance. The company listed capabilities that include credential theft, browser data collection, cryptocurrency wallet harvesting, Wi‑Fi credentials, keylogging, screen capture, and remote access. The framework also offers lateral movement and multiple defense-evasion capabilities.
In addition to collection and remote control functions, the framework contains a screen-locking ransomware module that displays customized ransom demands payable in Bitcoin or the Tether stablecoin (USDT). Talos emphasized that the module encrypted no files — it relied on a screen lock — and therefore left no forensic trail of file-modification timestamps or encryption markers. Talos noted that a screen lock is considerably faster to deploy than file-encrypting ransomware.
Why Cisco Talos says NIK C2 reshapes adversary tradecraft
Talos argued the integration of collection, AI-assisted processing, and exploitation collapses steps that previously occurred in sequence. The company wrote that NIK C2 reshapes adversary tradecraft "by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows." In other words, attackers can collect, analyze with AI, and act inside the same live session on the compromised host.
What this means for security teams, organizations with OpenAI API keys, and defenders
- Security teams: The tight coupling of collection and AI processing reduces the time between compromise and exploitation, shrinking windows for detection and incident response.
- Organizations with OpenAI API keys: Systems that store or expose an OPENAI_API_KEY environment variable on Windows machines could have their cloud usage and billing abused directly by NIK C2, with OpenAI logs showing the victim key as the origin of requests.
- Defenders and incident responders: The use of a non-file-encrypting screen-lock ransomware module means traditional file-modification indicators may be absent, requiring attention to remote control, process, and environment-variable artifacts rather than filesystem encryption markers.
Talos’ findings present a concrete shift: an implant that not only steals data but also uses the compromised host to perform AI-assisted analysis and hides the attacker’s footprint by relying on the victim’s own cloud credentials. With multiple versions and active infrastructure observed, Talos assessed NIK C2 as operational — and its design choices mean defenders must contend with faster, more opaque attack cycles and billing-linked evidence trails that point to victims rather than operators.
