{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/chat-completions-api/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Chat Completions API"],"_cs_severities":["high"],"_cs_tags":["C2","ransomware","ai-enabled","malware"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eNIK C2 is a cross-compiled Go-based remote access tool for Windows that enables persistent control, surveillance, and ransomware deployment. The framework uniquely integrates with the OpenAI Chat Completions API, allowing operators to send harvested victim data directly to LLMs for analysis. A notable feature is the abuse of victim-side environment variables (\u003ccode\u003eOPENAI_API_KEY\u003c/code\u003e) to facilitate AI requests, effectively offloading billing and logging to the victim's account.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial infection via unknown vector.\u003c/li\u003e\n\u003cli\u003eExecution of the 64-bit Go-based implant on the Windows host.\u003c/li\u003e\n\u003cli\u003eEstablishment of a dual-channel C2 connection using TLS WebSockets (port 443) and HTTP polling fallback.\u003c/li\u003e\n\u003cli\u003eHarvesting of credentials and keystroke data via internal implant modules.\u003c/li\u003e\n\u003cli\u003eRouting of harvested data to the OpenAI Chat Completions API using the victim’s environment-configured API key.\u003c/li\u003e\n\u003cli\u003eDeployment of desktop screen-locking ransomware to facilitate extortion.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe framework facilitates automated data analysis, credential theft, and ransomware operations. The AI-integration module specifically allows attackers to offload costs and obfuscate malicious API usage by abusing the credentials of the compromised host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock identified C2 infrastructure (87.120.196.120 and total-sitevv.lol) at the perimeter.\u003c/li\u003e\n\u003cli\u003eImplement process-creation monitoring to identify unauthorized Go-compiled binaries running from non-standard directories.\u003c/li\u003e\n\u003cli\u003eAudit environment variables on critical Windows systems for the presence of \u003ccode\u003eOPENAI_API_KEY\u003c/code\u003e to prevent unauthorized API abuse by malware.\u003c/li\u003e\n\u003cli\u003eReview network egress logs for frequent HTTPS requests to \u003ccode\u003eapi.openai.com\u003c/code\u003e originating from service accounts or non-development workstations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T12:09:58Z","date_published":"2026-10-29T12:09:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nik-c2/","summary":"NIK C2 is a Go-based Windows remote access tool that leverages OpenAI API integration to perform AI-assisted data analysis while exfiltrating credentials and deploying ransomware.","title":"NIK C2: AI-enabled remote access framework","url":"https://feed.craftedsignal.io/briefs/2026-10-nik-c2/"}],"language":"en","title":"CraftedSignal Threat Feed - Chat Completions API","version":"https://jsonfeed.org/version/1.1"}