Cisco Talos Details NIK C2, an AI-Integrated Windows Implant
Summary
Cisco Talos analyzed NIK C2, a Go-based Windows implant observed in the wild. It can steal credentials and other data, route operator prompts through OpenAI's API, maintain dual-channel C2, evade defenses, and deploy a persistent screen locker.
Key points
- Talos observed NIK C2 samples and an active C2 server; it assessed with moderate confidence that the framework was operational, not merely a proof of concept.
- The 64-bit Go implant uses TLS-secured WebSockets and an HTTP polling fallback, encrypts traffic with AES-256-GCM, and can rotate among prioritized C2 addresses.
- Its AI command sends operator prompts to the OpenAI Chat Completions API and returns generated text to the C2. If no actor API key is supplied, the implant can use the victim's OPENAI_API_KEY, potentially billing the victim's account.
- Documented theft and surveillance functions include browser credentials and cookies, Wi-Fi passwords, cryptocurrency wallets, keystrokes, screenshots, and clipboard contents.
- Persistence and evasion features include registry autostart, process masquerading, AMSI bypass, UAC bypass, and process hollowing.
- The ransomware module deploys a persistent screen lock but does not encrypt files. Its bootkit-preparation feature writes a placeholder staging file, not an actual bootkit.
Article Details
- Attack Vectors
- The NIK C2 Windows implant maintains C2 over TLS-secured WebSockets on port 443, with an HTTP polling fallback approximately every 250 milliseconds.
- The implant collects browser credentials and cookies, Discord tokens, Wi-Fi passwords, wallet data, and keystrokes, then sends results to the C2 server over its encrypted channels.
- C2 commands can route actor traffic through the victim into an internal network and interact with RDP sessions on other Windows hosts.
- The implant can send actor prompts to the OpenAI Chat Completions API from the compromised host; if the actor supplies no API key, it can use the victim machine's OPENAI_API_KEY environment variable.
- The implant can deploy a persistent screen-locking ransom demand using generated HTML launched with mshta.exe and a Windows Registry Run key; it does not encrypt files.
- Defensive Notes
- The article says the ClamAV signature Win.Trojan.GoDiscorder-10060526-0 detects and blocks this threat.
- Talos recommends continuous behavioral vigilance beyond traditional detection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | total-sitevv[.]lol | Domain resolving to the server Talos observed hosting the NIK C2 framework. |
| IPV4 | 87[.]120[.]196[.]120 | IP address of the server Talos observed hosting the NIK C2 framework. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe implant is described as supporting credential dumping.T1021.001 · Remote Desktop ProtocolThe implant supports RDP session interaction for lateral movement to other Windows hosts.T1041 · Exfiltration Over C2 ChannelThe implant sends collected data to its C2 through the WebSocket channel or an HTTP POST fallback.T1055.012 · Process HollowingProcess hollowing is listed among the implant's evasion capabilities.T1056.001 · KeyloggingThe implant captures keystrokes and streams them to the actor's panel.T1059.001 · PowerShellThe implant executes PowerShell commands for disk reading and runs an embedded PowerShell script for its AMSI bypass.T1071.001 · Web ProtocolsThe implant communicates with its C2 over TLS-secured WebSockets and HTTP polling.T1090.001 · Internal ProxyAn embedded proxy can route actor traffic through the victim into an internal network.T1113 · Screen CaptureThe implant supports full-screen screenshots and continuous screen streaming.T1218.005 · MshtaThe generated lock-screen HTML is launched with mshta.exe.T1547.001 · Registry Run Keys / Startup FolderThe implant configures Windows autostart Registry entries, including a Run key for the screen-locking payload.T1548.002 · Bypass User Account ControlThe implant can use fodhelper.exe and a COM hijack to elevate privileges without a UAC prompt.T1555.003 · Credentials from Web BrowsersThe implant stages browser databases, unwraps the DPAPI-protected AES key, and decrypts browser credential data locally.T1562.001 · Disable or Modify ToolsThe implant patches the AmsiInitFailed field in System.Management.Automation.dll to disable AMSI content inspection for the PowerShell session.T1573.001 · Symmetric CryptographyC2 messages and collected results are encrypted using AES-256-GCM with a key derived from a hardcoded seed.