Threat video1:00
NIK C2 Go Implant Abusing OpenAI: Detection & IOCs
NIK C2's Go implant sends prompts to OpenAI with the victim's own API key. Includes 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for NIK C2 Go Implant Abusing OpenAI: Detection & IOCs →
Chapters
- 0:00The hookAI malware with 52 commands: ransomware and espionage.
- 0:05The storyLate 2024 samples appeared.
- 0:11Attack pathIt checks for debuggers, disabling defenses.
- 0:27AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise21 indicators to hunt: 2 IPs, 1 domain and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques25 ATT&CK techniques, from execution to command and control.
- 0:43Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AI malware with 52 commands: ransomware and espionage.
0:05Late 2024 samples appeared.
0:08Talos disclosed an active C2 server.
0:11It checks for debuggers, disabling defenses.
0:14Then persists via registry and COM.
0:17Connects over encrypted TLS with pinning.
0:20Runs prompts on the victim's API key.
0:22Displays a lock screen ransomware message.
0:28No threat actor: this was defensive research.
0:3221 indicators to hunt: 2 IPs, 1 domain and 2 URLs, and more.
0:3925 ATT&CK techniques, from execution to command and control.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.