NIK-C2NIK C2

AI-integrated command-and-control framework reported and named by Cisco Talos, observed in the wild with a panel hosted at 87.120.196[.]120 (total-sitevv[.]lol, certificate CN nik-panel). Its Go-based 64-bit Windows implant (build path /opt/nik_panel/…, at least three versions) talks to the C2 over TLS WebSockets on port 443 with an HTTP polling fallback every 250 ms, encrypts traffic with AES-256-GCM from a hardcoded seed, and rotates across three tiers of C2 addresses. More than 52 commands cover credential, cookie, Discord token, Wi-Fi and cryptocurrency wallet theft, keylogging streamed live, screen, camera and microphone capture, HVNC, SOCKS5 and reverse proxy pivoting, RDP operations, AMSI patching, fodhelper UAC bypass, process hollowing and critical-process protection. Its ai_generate command sends operator prompts to the OpenAI Chat Completions API from the victim's machine, falling back to the victim's own OPENAI_API_KEY. It can also back up the MBR, stage a bootkit placeholder and deploy an HTML screen-locking ransomware demanding Bitcoin or USDT. Not attributed to a known actor.