NIK C2: AI-enabled remote access framework

NIK C2 is a cross-compiled Go-based remote access tool for Windows that enables persistent control, surveillance, and ransomware deployment. The framework uniquely integrates with the OpenAI Chat Completions API, allowing operators to send harvested victim data directly to LLMs for analysis. A notable feature is the abuse of victim-side environment variables (OPENAI_API_KEY) to facilitate AI requests, effectively offloading billing and logging to the victim's account.

Attack Chain

1. Initial infection via unknown vector.
2. Execution of the 64-bit Go-based implant on the Windows host.
3. Establishment of a dual-channel C2 connection using TLS WebSockets (port 443) and HTTP polling fallback.
4. Harvesting of credentials and keystroke data via internal implant modules.
5. Routing of harvested data to the OpenAI Chat Completions API using the victim’s environment-configured API key.
6. Deployment of desktop screen-locking ransomware to facilitate extortion.

Impact

The framework facilitates automated data analysis, credential theft, and ransomware operations. The AI-integration module specifically allows attackers to offload costs and obfuscate malicious API usage by abusing the credentials of the compromised host.

Recommendation

• Block identified C2 infrastructure (87.120.196.120 and total-sitevv.lol) at the perimeter.
• Implement process-creation monitoring to identify unauthorized Go-compiled binaries running from non-standard directories.
• Audit environment variables on critical Windows systems for the presence of OPENAI_API_KEY to prevent unauthorized API abuse by malware.
• Review network egress logs for frequent HTTPS requests to api.openai.com originating from service accounts or non-development workstations.