# NIK C2: AI-enabled Go-based command-and-control framework with OpenAI API abuse, infostealer, HVNC and lock-screen ransomware modules (Cisco Talos)

> Cisco Talos identified NIK C2, a fully functional (not proof-of-concept) Go-based Windows C2 framework hosted by a threat actor, whose implant embeds an OpenAI Chat Completions client so prompts execute from infected hosts using the victim's own API key. The implant bundles 52+ commands covering credential and crypto-wallet theft, surveillance, HVNC, proxying, defense evasion, a lock-screen ransomware module and bootkit-preparation checks.

- **Published:** 2026-10-29T10:29:15Z
- **Last reviewed:** 2026-10-29T10:29:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4727
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4727.png
- **ID:** TL-2026-4727
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

NIK C2 is a 64-bit Windows implant written in Go (compiled with Go 1.23.4, released December 2024, so all samples date from late 2024 onward) paired with a server-side panel. The build path string /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go and a TLS certificate with CN nik-panel tie the implant to the panel Talos saw hosted at 87.120.196.120 / total-sitevv.lol. Three variants were observed in OSINT, which Talos says points to a technically proficient team with prior malware experience expanding the framework. PE TimeDateStamp fields are zeroed and filesystem timestamps are set to 1979-11-29 across all samples.

Communications use a TLS WebSocket on port 443 as the primary channel (with certificate pinning, which defeats interception proxies) and an HTTP polling fallback that beacons every 250 ms to /api/c2/update. Endpoints include /api/c2/result, /api/c2/screen, /api/c2/file_chunk, /api/c2/rproxy_up and /api/c2/ws. All traffic is AES-256-GCM encrypted (12-byte random nonce, base64 of nonce+ciphertext+tag) using a key derived from a hardcoded, obfuscated seed. C2 addressing has three tiers: runtime-updated URLs, an encrypted server list and a hardcoded fallback. Implants identify themselves with IDs of the form ag_<16 hex chars> and register hostname, LAN IP, username, SID, local reverse-proxy port and upstream proxy settings on connect.

The AI capability is the `ai_generate` command: it takes a prompt, API key and model, defaults to gpt-4, falls back to the OPENAI_API_KEY environment variable on the host, calls https://api.openai.com/v1/chat/completions with a 60-second timeout and returns the model output and token usage to the C2. Inference cost therefore bills to the victim's OpenAI account, and Talos notes this collapses collection and analysis into a single continuous session.

The stealer set targets Chrome, Edge, Brave, Opera and Firefox credential/cookie stores (DPAPI master key extraction), Wi-Fi profiles and keys via netsh, Discord tokens, desktop and extension crypto wallets, and regex scans for seed phrases and private keys. Surveillance includes streaming keylogging, screenshots, camera and microphone capture, and clipboard interception/replacement. Remote control includes hidden VNC (HVNC), RDP session interaction, an embedded SOCKS5/HTTP proxy and a reverse TCP tunnel over WebSocket.

Evasion and persistence include marking the process critical via NtSetInformationProcess (0x1D, BreakOnTermination), PowerShell AMSI patching of AmsiInitFailed, debugger detection, masquerading as svchost.exe/simvol.exe/csrss.exe, Registry Run keys, COM hijacking, a watchdog subprocess, and a fodhelper.exe UAC bypass through HKCU\Software\Classes\ms-settings\Shell\Open\command. The ransomware module does not encrypt files: it backs up the MBR to mbr_backup.bin, writes lock_screen.html (Bitcoin/USDT addresses, price, email, timer) and lock_start.bat, launches it with mshta.exe in a restart loop and adds a SystemLock Run key. A bootkit-preparation module enumerates UEFI/BIOS and Secure Boot state and stages a placeholder bootkit.bin containing NIK_BOOTKIT_PREP. No CVE and no actor attribution are stated in the source.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1546.015 Component Object Model Hijacking
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1622 Debugger Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1218.005 Mshta
- T1112 Modify Registry
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1563.002 RDP Hijacking
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1008 Fallback Channels
- T1090 Proxy
- T1055.012 Process Hollowing
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NIK C2 (TL-2026-4727) fodhelper.exe UAC Bypass via ms-settings Command Hijack** (`TL-2026-4727-SPL-001`)

Detects the NIK C2 implant's UAC bypass: a write to HKCU\Software\Classes\ms-settings\Shell\Open\command (Sysmon registry events 12/13/14) followed by fodhelper.exe spawning an elevated child. NIK C2 deletes the key about two seconds after use, so the registry write is the durable signal; a fodhelper.exe child on the same host raises confidence. Behaviour-first and independent of file hashes or infrastructure.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548.002, T1112, T1546.015
- **Data sources:** sysmon, windows_registry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode IN (12,13,14) TargetObject="*\\ms-settings\\Shell\\Open\\command*") OR (EventCode=1 ParentImage="*\\fodhelper.exe"))
| eval signal=if(EventCode=1,"fodhelper_child_process","ms_settings_command_hijack")
| stats min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(TargetObject) as registry_keys values(Details) as hijack_command values(Image) as writer_or_child_images values(CommandLine) as child_cmdlines by host
| where isnotnull(mvfind(signals,"ms_settings_command_hijack"))
| eval fodhelper_triggered=if(isnotnull(mvfind(signals,"fodhelper_child_process")),"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host signals fodhelper_triggered registry_keys hijack_command writer_or_child_images child_cmdlines
```

### Microsoft KQL

```kql
let lookback = 24h;
let hijack = DeviceRegistryEvents
    | where Timestamp > ago(lookback)
    | where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
    | where RegistryKey has @"ms-settings\Shell\Open\command"
    | project HijackTime = Timestamp, DeviceName, Account = InitiatingProcessAccountName, WriterProcess = InitiatingProcessFileName, WriterCommandLine = InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData;
let trigger = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "fodhelper.exe"
    | project TriggerTime = Timestamp, DeviceName, ElevatedChild = FileName;
hijack
| join kind=leftouter trigger on DeviceName
| where isempty(TriggerTime) or TriggerTime between (HijackTime .. (HijackTime + 2m))
| summarize FirstSeen = min(HijackTime), LastSeen = max(HijackTime), FodhelperChildren = countif(isnotempty(TriggerTime)), ElevatedChildren = make_set(ElevatedChild, 10) by DeviceName, Account, WriterProcess, WriterCommandLine, RegistryKey, RegistryValueData
| extend FodhelperTriggered = FodhelperChildren > 0
```

### Sigma

```yaml
title: NIK C2 fodhelper UAC Bypass via ms-settings Command Hijack
id: 7c1e5a42-3b9d-4f6e-8a21-5d0c9e4b7a11
status: experimental
description: Detects creation or modification of the ms-settings Shell Open command registry key used by NIK C2 (TL-2026-4727) to hijack fodhelper.exe and elevate silently. The implant removes the key about two seconds after use.
references:
    - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
    - https://attack.mitre.org/techniques/T1548/002/
author: Threadlinqs Team
date: 2026-10-29
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1548.002
    - attack.t1112
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\ms-settings\Shell\Open\command'
    condition: selection
falsepositives:
    - Rare legitimate software registering a custom ms-settings URI handler
    - Authorised red-team UAC bypass testing
level: high

```

**Known false positives:**

- Authorised red-team or purple-team UAC bypass exercises
- Software that registers an ms-settings protocol handler under HKCU (very rare)

**Tuning notes:** Requires Sysmon registry events (12/13/14) with the ms-settings key not excluded in the Sysmon config. Allow-list sanctioned test hosts by host or user. Any hit is high-fidelity; fodhelper_triggered=yes should page.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NIK C2 (TL-2026-4727) PowerShell AMSI Patching via AmsiInitFailed (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) [indicator] Credential Archive Staging (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) OpenAI API Access from Untrusted or Masquerading Process (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) Process Masquerading as svchost.exe, csrss.exe or simvol.exe (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) Registry Persistence: [indicator] Run Key and User-Path COM Hijack (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) DNS Resolution of [indicator] C2 Domain (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) Lock-Screen Ransomware Module Artifacts and mshta Launch (locked: unlock with TL Creds)
- NIK C2 (TL-2026-4727) Network Contact with C2 Infrastructure and /api/c2/ Endpoints (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `87.120.196[.]120`
- Domain: `total-sitevv[.]lol`
- File hash: `ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [NIK C2: The new AI-enabled command-and-control framework](https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/)
- [Cisco Talos IOCs repository - NIK C2 indicators (TXT)](https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2026/10/nik-c2-new-ai-enabled-framework.txt)
- [Cisco Talos IOCs repository - 2026/10 directory](https://github.com/Cisco-Talos/IOCs/tree/main/2026/10)
- [MITRE ATT&CK T1548.002 - Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002/)
- [MITRE ATT&CK T1546.015 - Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015/)
- [MITRE ATT&CK T1562.001 - Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4727