Cisco Talos Finds NIK C2 Malware Using OpenAI API

Cisco Talos detailed NIK C2, a newly observed AI enabled command and control framework, in a company blog post. Its 64 bit Windows implant supports credential dumping, keystroke collection, remote desktop session hijacking, process hollowing and screen locking ransomware.

The implant uses TLS WebSockets on port 443, with an HTTP polling channel as a fallback. It encrypts traffic with AES 256 GCM and can switch among updated URLs, an encrypted server list and a hardcoded fallback address.

NIK C2 also includes a client for the OpenAI Chat Completions API. Operators can send prompts through an infected computer, ask a model to analyze collected information and receive the response through the command and control panel.

If an operator does not supply an API key, the implant reads the OPENAI_API_KEY environment variable on the infected computer and uses the victim's own key. It defaults to gpt-4 when no model is named, and operators can pass any other valid OpenAI model name. Having seen an active NIK C2 server in the wild, Talos assessed with moderate confidence that the framework is more than a proof of concept.