NIK C2 joins data theft with screen-locking ransomware
Cisco Talos found NIK C2, a Windows command-and-control (C2) framework, in the wild; its implant combines credential and keystroke theft, AI-assisted analysis, and screen-locking ransomware.
The operator can send material gathered from a victim’s computer to OpenAI’s Chat Completions application programming interface (API) and receive analysis through the compromised session, without first exporting the data for separate review. The same implant can lock the desktop and demand Bitcoin or USDT, linking data theft to visible disruption without a separate tool.
For organizations with Windows workstations, a detected host may already have exposed credentials and sensitive data before response begins, while screen locking can disrupt users at the same time. Talos reported these capabilities, but not that AI analysis automatically triggers a follow-on attack; how quickly stolen material is used remains uncertain.