Cyber — 2026-10-31

Cisco Talos Discovers AI-Enabled NIK C2 Framework That Collapses Collection and Exploitation Into Single Session

BLUFNIK C2's ability to route AI-driven analysis of stolen data through the victim's own API keys compresses the attacker's kill chain and demands that defenders treat anomalous outbound OpenAI traffic from endpoints as a direct intrusion indicator.

Cisco Talos reported on October 29 that it observed NIK C2, a Go-based 64-bit Windows implant with more than 52 commands, including credential dumping, keylogging, and RDP hijacking, in the wild 1. Its ai_generate command sends operator prompts to OpenAI's Chat Completions API from the infected host, defaulting to gpt-4, and uses the victim's OPENAI_API_KEY variable when no key is supplied 12. Talos identified a live server at 87.120.196[.]120, resolving to total-sitevv[.]lol, with a certificate common name of "nik-panel," and assessed with moderate confidence that the framework is operational rather than a proof of concept 1. Cyber Press and Mallory report the screen-locking ransomware module demands Bitcoin or USDT without encrypting files, and that the bootkit function stages only a placeholder 23.

Analysis
NIK C2 lets operators analyze stolen material through OpenAI from the victim host, so detection that assumes offline processing loses its window. Because ai_generate falls back to the victim's OPENAI_API_KEY, inference cost and log attribution shift to the victim, making unexpected OpenAI traffic from Windows endpoints a usable indicator. The ransomware module locks screens without encrypting files and the bootkit stages only a placeholder, so impact is currently limited to disruption and extortion. A live server and three implant versions point to active development that Talos judges operational. Confidence is low: Cisco Talos is the sole primary account, the other outlets are derivative, and there is no victim count or actor attribution. The ai_generate function may be only an operator triage convenience, and the framework a small crime-oriented project with limited reach.

4 sources

NIK C2: The new AI-enabled command-and-control framework - Cisco Talos
NIK C2 Malware Abuses OpenAI API to Analyze Stolen Data and Assist Hackers During Attacks - Cyber Press
NIK C2 Combines AI API Access With Windows Intrusions and Screen-Locking Ransomware - Mallory
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories - The Hacker News