NIK C2: AI-enabled Go-based command-and-control framework with OpenAI API abuse, infostealer, HVNC and lock-screen ransomware modules (Cisco Talos)

Key facts

Detection coverage

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4727 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NIK C2 (TL-2026-4727) fodhelper.exe UAC Bypass via ms-settings Command Hijack

Detects the NIK C2 implant's UAC bypass: a write to HKCU\Software\Classes\ms-settings\Shell\Open\command (Sysmon registry events 12/13/14) followed by fodhelper.exe spawning an elevated child. NIK C2 deletes the key about two seconds after use, so the registry write is the durable signal; a fodhelper.exe child on the same host raises confidence. Behaviour-first and independent of file hashes or infrastructure.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548.002, T1112, T1546.015
• Data sources: sysmon, windows_registry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode IN (12,13,14) TargetObject="*\\ms-settings\\Shell\\Open\\command*") OR (EventCode=1 ParentImage="*\\fodhelper.exe"))
| eval signal=if(EventCode=1,"fodhelper_child_process","ms_settings_command_hijack")
| stats min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(TargetObject) as registry_keys values(Details) as hijack_command values(Image) as writer_or_child_images values(CommandLine) as child_cmdlines by host
| where isnotnull(mvfind(signals,"ms_settings_command_hijack"))
| eval fodhelper_triggered=if(isnotnull(mvfind(signals,"fodhelper_child_process")),"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host signals fodhelper_triggered registry_keys hijack_command writer_or_child_images child_cmdlines

Microsoft KQL

let lookback = 24h;
let hijack = DeviceRegistryEvents
    | where Timestamp > ago(lookback)
    | where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
    | where RegistryKey has @"ms-settings\Shell\Open\command"
    | project HijackTime = Timestamp, DeviceName, Account = InitiatingProcessAccountName, WriterProcess = InitiatingProcessFileName, WriterCommandLine = InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData;
let trigger = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "fodhelper.exe"
    | project TriggerTime = Timestamp, DeviceName, ElevatedChild = FileName;
hijack
| join kind=leftouter trigger on DeviceName
| where isempty(TriggerTime) or TriggerTime between (HijackTime .. (HijackTime + 2m))
| summarize FirstSeen = min(HijackTime), LastSeen = max(HijackTime), FodhelperChildren = countif(isnotempty(TriggerTime)), ElevatedChildren = make_set(ElevatedChild, 10) by DeviceName, Account, WriterProcess, WriterCommandLine, RegistryKey, RegistryValueData
| extend FodhelperTriggered = FodhelperChildren > 0

Sigma

title: NIK C2 fodhelper UAC Bypass via ms-settings Command Hijack
id: 7c1e5a42-3b9d-4f6e-8a21-5d0c9e4b7a11
status: experimental
description: Detects creation or modification of the ms-settings Shell Open command registry key used by NIK C2 (TL-2026-4727) to hijack fodhelper.exe and elevate silently. The implant removes the key about two seconds after use.
references:
    - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
    - https://attack.mitre.org/techniques/T1548/002/
author: Threadlinqs Team
date: 2026-10-29
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1548.002
    - attack.t1112
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\ms-settings\Shell\Open\command'
    condition: selection
falsepositives:
    - Rare legitimate software registering a custom ms-settings URI handler
    - Authorised red-team UAC bypass testing
level: high

Known false positives:

• Authorised red-team or purple-team UAC bypass exercises
• Software that registers an ms-settings protocol handler under HKCU (very rare)

Tuning notes: Requires Sysmon registry events (12/13/14) with the ms-settings key not excluded in the Sysmon config. Allow-list sanctioned test hosts by host or user. Any hit is high-fidelity; fodhelper_triggered=yes should page.

• 🔒 NIK C2 (TL-2026-4727) PowerShell AMSI Patching via AmsiInitFailed · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) [indicator] Credential Archive Staging · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) OpenAI API Access from Untrusted or Masquerading Process · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) Process Masquerading as svchost.exe, csrss.exe or simvol.exe · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) Registry Persistence: [indicator] Run Key and User-Path COM Hijack · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) DNS Resolution of [indicator] C2 Domain · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) Lock-Screen Ransomware Module Artifacts and mshta Launch · unlock with TL Creds
• 🔒 NIK C2 (TL-2026-4727) Network Contact with C2 Infrastructure and /api/c2/ Endpoints · unlock with TL Creds

Indicators of compromise

As of 2026-10-29, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-4727.

Sample indicators (3 of 25)

• IP address: 87.120.196[.]120
• Domain: total-sitevv[.]lol
• File hash: ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Technical analysis

NIK C2 is a 64-bit Windows implant written in Go (compiled with Go 1.23.4, released December 2024, so all samples date from late 2024 onward) paired with a server-side panel. The build path string /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go and a TLS certificate with CN nik-panel tie the implant to the panel Talos saw hosted at 87.120.196.120 / total-sitevv.lol. Three variants were observed in OSINT, which Talos says points to a technically proficient team with prior malware experience expanding the framework. PE TimeDateStamp fields are zeroed and filesystem timestamps are set to 1979-11-29 across all samples.

Communications use a TLS WebSocket on port 443 as the primary channel (with certificate pinning, which defeats interception proxies) and an HTTP polling fallback that beacons every 250 ms to /api/c2/update. Endpoints include /api/c2/result, /api/c2/screen, /api/c2/file_chunk, /api/c2/rproxy_up and /api/c2/ws. All traffic is AES-256-GCM encrypted (12-byte random nonce, base64 of nonce+ciphertext+tag) using a key derived from a hardcoded, obfuscated seed. C2 addressing has three tiers: runtime-updated URLs, an encrypted server list and a hardcoded fallback. Implants identify themselves with IDs of the form ag_<16 hex chars> and register hostname, LAN IP, username, SID, local reverse-proxy port and upstream proxy settings on connect.

The AI capability is the `ai_generate` command: it takes a prompt, API key and model, defaults to gpt-4, falls back to the OPENAI_API_KEY environment variable on the host, calls https://api.openai.com/v1/chat/completions with a 60-second timeout and returns the model output and token usage to the C2. Inference cost therefore bills to the victim's OpenAI account, and Talos notes this collapses collection and analysis into a single continuous session.

The stealer set targets Chrome, Edge, Brave, Opera and Firefox credential/cookie stores (DPAPI master key extraction), Wi-Fi profiles and keys via netsh, Discord tokens, desktop and extension crypto wallets, and regex scans for seed phrases and private keys. Surveillance includes streaming keylogging, screenshots, camera and microphone capture, and clipboard interception/replacement. Remote control includes hidden VNC (HVNC), RDP session interaction, an embedded SOCKS5/HTTP proxy and a reverse TCP tunnel over WebSocket.

Evasion and persistence include marking the process critical via NtSetInformationProcess (0x1D, BreakOnTermination), PowerShell AMSI patching of AmsiInitFailed, debugger detection, masquerading as svchost.exe/simvol.exe/csrss.exe, Registry Run keys, COM hijacking, a watchdog subprocess, and a fodhelper.exe UAC bypass through HKCU\Software\Classes\ms-settings\Shell\Open\command. The ransomware module does not encrypt files: it backs up the MBR to mbr_backup.bin, writes lock_screen.html (Bitcoin/USDT addresses, price, email, timer) and lock_start.bat, launches it with mshta.exe in a restart loop and adds a SystemLock Run key. A bootkit-preparation module enumerates UEFI/BIOS and Secure Boot state and stages a placeholder bootkit.bin containing NIK_BOOTKIT_PREP. No CVE and no actor attribution are stated in the source.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1090 Proxy; T1573.001 Symmetric Cryptography

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1622 Debugger Evasion

Credential Access

T1056.001 Keylogging; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Execution

T1059.001 PowerShell

Discovery

T1082 System Information Discovery

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Persistence

T1546.015 Component Object Model Hijacking; T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002 Bypass User Account Control

Lateral Movement

T1563.002 RDP Hijacking

Remediation

Immediate actions

• Block 87.120.196.120, 2.26.51.12 and total-sitevv.lol at the perimeter and DNS layers
• Hunt for HKCU\Software\Classes\ms-settings\Shell\Open\command writes followed by fodhelper.exe execution
• Hunt for mshta.exe launching lock_screen.html from temp, lock_start.bat and a SystemLock Run key
• Rotate any OpenAI API keys and browser-stored credentials, Discord tokens and wallet seeds on hosts where NIK C2 is found; review OpenAI usage and billing for unexplained activity

Workarounds

• Set UAC to Always Notify to hinder the fodhelper.exe bypass
• Restrict mshta.exe via application control where not required

Longer-term hardening

• Deploy EDR with behavioral detection for AMSI tampering, critical-process flags (NtSetInformationProcess 0x1D) and process masquerading
• Do not store OpenAI API keys in persistent user environment variables on endpoints; use scoped, rotated keys with spend limits
• Alert on non-system processes named svchost.exe/csrss.exe/simvol.exe running outside System32
• Monitor for Go-compiled binaries with zeroed PE timestamps

Affected and fixed versions

• Microsoft — Windows (64-bit)
  Vulnerable versions: Windows endpoints where the NIK implant executes
• OpenAI — OpenAI API accounts / keys on infected hosts
  Vulnerable versions: Keys supplied by the actor or read from the OPENAI_API_KEY environment variable

Timeline

• 2024-12-03 Go 1.23.4 released (December 2024); NIK C2 samples were built with this toolchain, so none can predate late 2024. PE timestamps are zeroed, so actual compile dates are unknown.
• 2026-10-29 Talos reported the active C2 server at locked-ioc-16 (locked-ioc-13, cert CN nik-panel) hosting the NIK C2 panel during its research period; exact observation date not stated, publication date used.
• 2026-10-29 Talos reported three NIK C2 implant variants sighted in OSINT with a progressive pace of capability addition (Figure 2), indicating an actively developed framework; individual sighting dates are not stated, publication date used.
• 2026-10-29 Talos documented coverage: ClamAV Win.Trojan.GoDiscorder-10060526-0, plus Talos DNS Security, Malware Protection and Antivirus.
• 2026-10-29 Talos released NIK C2 indicators (8 SHA-256 hashes, locked-ioc-13, locked-ioc-16, locked-ioc-20, C2 endpoints) in its public IOCs repository under 2026/10.
• 2026-10-29 Cisco Talos published 'NIK C2: The new AI-enabled command-and-control framework' describing a fully functional framework hosted by a threat actor.

Sources cited

• MITRE ATT&CK T1548.002 - Bypass User Account Control MITRE · Advisory
• MITRE ATT&CK T1546.015 - Component Object Model Hijacking MITRE · Advisory
• MITRE ATT&CK T1562.001 - Impair Defenses: Disable or Modify Tools MITRE · Advisory
• NIK C2: The new AI-enabled command-and-control framework Cisco Talos · Research · 2026-10-29
• Cisco Talos IOCs repository - NIK C2 indicators (TXT) raw.githubusercontent.com · Code repository · 2026-10-29
• Cisco Talos IOCs repository - 2026/10 directory GitHub · Code repository · 2026-10-29

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• NetamLoader: Unknown APT Targets Government-Customized Windows 10 OS in Asia via Patch My PC-Themed XAML/.NET Loader Previous report
• INJ3CTOR3 Campaign Targets FreePBX Servers with JOMANGY/ZenharR Webshells to Steal SIP Credentials for Phone Fraud Next report