New NIK C2 Malware Gives Attackers Remote Control and a Built-In Link to OpenAI

Cisco Talos has analysed NIK C2, a remote access tool written in Go for 64-bit Windows. It gives attackers persistent control over infected computers. It communicates over encrypted web traffic on port 443, with a backup method that checks in every 250 milliseconds. To resist takedowns, it uses three tiers of control servers: addresses updated while it runs, an embedded encrypted server list, and a hardcoded fallback address.

The tool offers a wide range of capabilities, including credential dumping, RDP session hijacking, process hollowing and a screen lock ransomware module controlled by the attacker. What stands out is an ai_generate command. It embeds an OpenAI API client, so operators can send prompts to the OpenAI Chat Completions API through the infected host. The implant handles the API key, builds the request, reads the response and returns the encrypted result to the attacker's server.

Talos found a build path suggesting the project is called "nik_panel" and was built for Windows from a Linux environment. Its infrastructure appears to track and version each implant. Talos has seen at least three versions, all compiled with Go 1.23.4, so none predate late 2024. The samples also have altered timestamps, which can make analysis harder. Talos believes an experienced, technically skilled team is expanding NIK C2 into a full-service attack framework.