As cited
Copy frozen at (site build).
threat intel
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos discovered NIK C2, a Go-based Windows remote access tool that integrates artificial intelligence (AI) functionality to automate data collection and analysis during active compromise. The implant abuses OpenAI's application programming interface (API) to route prompts through infected hosts, enabling operators to dynamically process stolen credentials, keystrokes, and system data without offline delays. Beyond surveillance and theft capabilities, NIK C2 deploys screen-locking ransomware, maintains persistence through multiple channels including WebSocket and HTTP fallback, and implements evasion techniques such as Antimalware Scan Interface (AMSI) bypass and process termination protection.
Why it matters: Defenders and incident responders must account for threat actors who now collapse data collection and exploitation into real-time sessions with AI-driven analysis, eliminating historical detection windows and requiring continuous behavioral monitoring rather than traditional signature-based approaches.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos discovered NIK C2, a Go-based Windows remote access tool that integrates artificial intelligence (AI) functionality to automate data collection and analysis during active compromise. The implant abuses OpenAI's application programming interface (API) to route prompts through infected hosts, enabling operators to dynamically process stolen credentials, keystrokes, and system data without offline delays. Beyond surveillance and theft capabilities, NIK C2 deploys screen-locking ransomware, maintains persistence through multiple channels including WebSocket and HTTP fallback, and implements evasion techniques such as Antimalware Scan Interface (AMSI) bypass and process termination protection.
Why it matters: Defenders and incident responders must account for threat actors who now collapse data collection and exploitation into real-time sessions with AI-driven analysis, eliminating historical detection windows and requiring continuous behavioral monitoring rather than traditional signature-based approaches.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos discovered NIK C2, a Go-based Windows remote access tool that integrates artificial intelligence (AI) functionality to automate data collection and analysis during active compromise. The implant abuses OpenAI's application programming interface (API) to route prompts through infected hosts, enabling operators to dynamically process stolen credentials, keystrokes, and system data without offline delays. Beyond surveillance and theft capabilities, NIK C2 deploys screen-locking ransomware, maintains persistence through multiple channels including WebSocket and HTTP fallback, and implements evasion techniques such as Antimalware Scan Interface (AMSI) bypass and process termination protection.
Why it matters: Defenders and incident responders must account for threat actors who now collapse data collection and exploitation into real-time sessions with AI-driven analysis, eliminating historical detection windows and requiring continuous behavioral monitoring rather than traditional signature-based approaches.
- Source published
- First seen by Cybersecurity Tracker