NIK C2：濫用 OpenAI API、劫持 RDP 工作階段及鎖定螢幕的 Windows RAT

1. Basic Information

• Report Name: NIK C2: The new AI-enabled command-and-control framework
• Publisher: Cisco Talos
• Publication Date: 2026-10-29
• Source: Cisco Talos
• Related Sources: BleepingComputer: NIK C2
• Related Malware: NIK C2
• Related Threat Groups: None specified
• Related CVEs: None specified
• Related Products: Windows, OpenAI Chat Completions API, RDP
• Severity: high

2. Executive Summary

Talos has observed NIK C2, a Windows RAT written in Go, along with an active C2 infrastructure. Analysis has confirmed capabilities including TLS WebSocket/HTTP fallback, credential theft, RDP session hijacking, process hollowing, prompt transmission to the OpenAI API, and screen locking, though the execution count of each feature in actual incidents has not been publicly disclosed.

The framework warrants attention because it combines multi-tier C2, credential and crypto wallet theft, EDR evasion, and RDP session hijacking, and samples have been observed in the wild.

3. Attack Flow

Implementation-Level C2 Connection Path (Initial Access Vector Unknown)

1. After payload execution, it connects to the TLS WebSocket C2.
2. If WebSocket is unavailable, the implant can fall back to HTTP polling. The analyzed 250ms interval is an implementation value, and communication frequency alone does not confirm a compromise.

Functions Selectable and Executable from C2 (Order of Enumeration Does Not Reflect Execution Order)

1. Includes commands for credential and crypto wallet theft, keylogging, RDP session hijacking, and process hollowing.
2. ai_generate uses an API key and prompt to call the API and returns the result to C2. The process is not limited solely to command generation.
3. The screen locking feature is not file encryption. MBR backup is also a read operation, and MBR rewriting has not been confirmed. Execution records of each feature in actual incidents have not been publicly disclosed.

4. Attacker Position and Execution Location

• Communicates with an external C2 and the OpenAI API from a Windows endpoint.

5. Victim and Administrator Perspective

Victim

• A screen lock and ransom demand may appear.

Administrator

• Appears as WebSocket usage, high-frequency HTTP, AMSI patching, RDP manipulation, and Run keys.

6. Success and Failure Conditions

Success Conditions

• The payload must execute and reach external networks.
• The AI feature requires a valid API key and network reachability to the API. The victim's key can be used when the operator supplies no API key and the host has a usable key in the OPENAI_API_KEY environment variable.

Failure Conditions and Mitigations

• Apply application control, EDR, RDP restrictions, and egress allowlists.

7. What Happens Upon Success

• Theft of credentials and crypto wallet secrets.
• RDP takeover, command execution, and screen locking.

8. Observable Logs

Inference: The following are candidate logs to investigate within your organization. They depend on log collection and retention settings as well as product visibility, and do not imply that all items were confirmed recorded in the primary source.

• Email: None applicable
• Proxy / SWG / DNS: None applicable
• Endpoint / EDR: Confirm AMSI patching, process hollowing, mshta, Run keys, and RDP operations.
• Identity / IdP: None applicable
• SaaS / Cloud: None applicable
• Network: Confirm WebSocket traffic, 250ms polling, and OpenAI API requests.

9. Attack Success Determination

Inference: The following are determination criteria within your organization, and do not imply that the source observed all stages of success.

• Initial Execution Confirmed: Criteria: Confirm the NIK C2 process. Target: endpoint
• Data or Session Compromise Confirmed: Criteria: Confirm credential theft or RDP hijacking. Target: endpoint/session

10. Investigation Playbook

Inference: This is an investigative procedure for your organization.

• Trigger: Unknown Go binary, AMSI patching, RDP manipulation, high-frequency HTTP
• Initial Checks: Confirm target product versions, exposure scope, time synchronization, and log retention.
• Endpoint: Preserve target device settings, processes, files, and reboot history.
• Identity and Cloud: Confirm administrator authentication and API operations.
• Follow-on Activity: Track subsequent internal connections, credential usage, configuration changes, and outbound traffic.
• Containment: Isolate the target for evidence preservation, remove malware, or rebuild from a clean environment. Revoke and update potentially compromised credentials and API keys. Applying malware patches is not considered a mitigation.
• Assessment Categories: Record attempts, initial execution, successful authentication, data theft, and subsequent compromises separately.

11. Defense and Detection Ideas

• Single Events: Detect AMSI patching, process hollowing, and SystemLock.
• Timeline Correlation: Correlate C2 communication, credential access, and RDP operations.
• Hunting: Investigate unauthorized processes making OpenAI API communications.
• Logging Gaps: TLS and fallback mechanisms prevent confirming function execution through network traffic alone.
• Priority Controls: Prioritize EDR tamper protection, RDP least privilege, and egress controls.

12. Facts / Inference / Hypothesis

Facts

• Talos observed a real-world 64-bit Windows RAT NIK C2 sample written in Go and active C2 infrastructure, assessing with moderate confidence that it is a functional framework rather than a mere PoC. This is distinguished from confirmation of individual feature execution across all victims.
• Uses TLS WebSocket over port 443 as the primary channel, falling back to HTTP polling at 250ms intervals upon failure, encrypted with AES-256-GCM derived from a hardcoded seed.
• C2 URLs utilize a three-stage approach: runtime updates, encrypted embedded lists, and hardcoded fallbacks.
• Implements credential dumping, keylogging, RDP hijacking, process hollowing, AMSI patching, UAC bypassing, and theft of browser data, Discord tokens, crypto wallets, and seed phrases/private keys.
• ai_generate is an implementation that sends arbitrary prompts from the infected host to the OpenAI Chat Completions API and returns the response to C2. It utilizes the API key specified by the operator or the host's OPENAI_API_KEY environment variable, and lets the operator override the default gpt-4 model. This constitutes API abuse rather than an OpenAI compromise, and does not demonstrate that the model necessarily complied with malicious requests or that generated results were automatically executed.
• The ransomware module does not encrypt files. It backs up the MBR as a preparatory disk-read operation; screen locking is implemented through HTML launched by mshta, the SystemLock Run key, and a loop that reopens the lock screen after 5 seconds. The MBR backup does not maintain the screen lock or demonstrate MBR modification.
• Initial access, victim counts, and the actual execution frequency of ai_generate or screen locking features remain unknown.

Inference

• Inference: Correlate OpenAI API traffic with shell and process activities immediately before and after, without concluding a compromise based solely on API usage.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unknowns and Limitations".

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• Initial access, operators, victim counts, and execution records for AI/ransomware features are unknown.

15. Impact on SOCs and Organizations

Correlate Windows-endpoint communications to the OpenAI API or unknown WebSocket destinations with 250ms polling, AMSI patching, and RDP session hijacking.

16. Summary by Target

• SOC: Correlate C2 fallback, AMSI patching, credential access, and RDP hijacking.
• Administrators: Strengthen egress controls, RDP least privilege, and credential protection.
• Users: Disconnect network access and report immediately if a screen lock occurs.