NIK C2 malware abuses OpenAI API for credential theft and remote control
- Severity
- High
- Sources
- 1
What happened
NIK C2 is a Go-based 64-bit Windows implant reported by Cisco Talos, which assessed with moderate confidence that it is a working framework with at least three versions. Comms use TLS WebSockets on 443 plus an HTTP fallback polling about every 250 ms, with AES-256-GCM traffic encryption and JARM fingerprinting of the C2 server; the implant renames itself to svchost.exe or csrss.exe, patches AMSI, bypasses UAC via fodhelper, and sets itself as a critical process. Defenders should hunt for the listed IoCs (C2 IP, total-sitevv[.]lol domain, nik-panel certificate CN, /api/c2/ endpoints), the SystemLock Run key, and dropped files such as lockscreen.html and browserdata.zip, and check for the ClamAV signature Win.Trojan.GoDiscorder-10060526-0. Talos released the CAIRN toolkit to find AI endpoints and API-key patterns in suspicious files.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Hunt for the listed NIK C2 indicators of compromise, including the C2 IP address, domain, certificate and API endpoints, across logs and endpoints.
- Scan endpoints for the ClamAV signature Win.Trojan.GoDiscorder-10060526-0.
- Check for the SystemLock Run key and the dropped files lockscreen.html, lockstart.bat and browserdata.zip in the temp folder.
- Review systems for unexpected use of the OPENAIAPIKEY environment variable, since the implant falls back to it.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies