Malware · 3h ago
Cisco Talos found NIK C2, a Windows command-and-control (C2) framework, in the wild; its implant combines credential and keystroke theft, AI-assisted analysis, and screen-locking ransomware.
The operator can send material gathered from a victim’s computer to OpenAI’s Chat Completions application programming interface (API) and receive analysis through the compromised session, without first exporting the data for separate review. The same implant can lock the desktop and demand Bitcoin or USDT, linking data theft to visible disruption without a separate tool.
For organizations with Windows workstations, a detected host may already have exposed credentials and sensitive data before response begins, while screen locking can disrupt users at the same time. Talos reported these capabilities, but not that AI analysis automatically triggers a follow-on attack; how quickly stolen material is used remains uncertain.
1 source covering this story
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
Part of the PlainSec briefing for 2026-10-29