{"schema_version":"0.10.0","id":"LR-2026-0273","record_version":2,"title":"NIK C2 implant routes actor prompts to OpenAI API using victim's API key","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":57.5,"score_breakdown":{"source_authority":16.5,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":6.08,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-29","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-29","history":[{"date":"2026-10-29","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"ec8aa2af33fdd5423e3ca7f10a8644bd6c20830ddb8e55cf45907248ce6ed1c1"},"system":{"model_name":"GPT-4","model_version":null,"developer":"OpenAI","harness":"NIK C2 implant (Go-based Windows remote access tool with ai_generate command)","tools_granted":["credential_dump","keylogger","screen_capture","camera_audio","clipboard","hvnc","proxy","rdp","ransomware"],"permissions_scope":"Full control of the compromised Windows victim machine: desktop, files, credentials, wallets, network pivoting, and boot firmware.","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"enterprise","lifecycle_stage":"production","integration_type":"api","intended_use":"Route actor prompts to the OpenAI Chat Completions API from the infected host to analyze harvested victim data","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-29","incident_class":"security_compromise","failure_class":"unauthorized_communication","agent_involved":true,"secondary_failure_classes":["data_exfiltration"],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Cisco Talos observed NIK C2, a Go-based Windows implant that gives an actor persistent control of compromised hosts and embeds an OpenAI Chat Completions API client.","tags":["malware","command-and-control","ransomware","credential-theft","cryptocurrency-wallet-theft","keylogger","bootkit"],"date_detected":null,"near_miss":null,"root_cause":"unknown","root_cause_detail":"no source names what failed","failure_class_detail":"a source states the agent contacted a system, person or service outside its permitted scope","responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Live production compromise of victim hosts with credential theft, surveillance and ransomware capability, and no bounded scope stated.","harm_class":[],"affected_description":"Compromised Windows hosts and their users; victims' credentials, keystrokes, screen, camera, audio, clipboard, crypto wallets and OpenAI API keys","protected_class_involved":null,"data_categories_exposed":["credentials","cookies","crypto_wallets","discord_tokens","keystrokes","screen_capture","camera_audio","clipboard","wifi_passwords","api_keys"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/","publisher":"Cisco Talos","date":"2026-10-29","type":"vendor_research","title":"NIK C2: The new AI-enabled command-and-control framework","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.permissions_scope":"D","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.failure_class":"D","event.secondary_failure_classes":"D","event.tags":"C","event.root_cause":"D","event.responsible_party":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.systemic_exposure":"D","context.shared_model_id":"C","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Decoding the five-character value showed gpt-4 confirming that GPT4 is the default when no model is specified."}],"system.developer":[{"source_index":0,"quote":"In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP endpoint that enables ChatGPT-style conversations programmatically."}],"system.harness":[{"source_index":0,"quote":"Notably, the NIK C2 implant embeds a fully integrated OpenAI API client via its ai_generate command, allowing operators to route arbitrary prompts to the OpenAI Chat Completions API directly through the infected host."}],"system.tools_granted":[{"source_index":0,"quote":"Beyond standard operations, the implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module."}],"system.permissions_scope":[{"source_index":0,"quote":"| Remote Control | HVNC | Hidden Virtual Network Computing — full desktop control invisible to the victim. |"}],"system.deployment_context":[{"source_index":0,"quote":"By embedding a live AI pipeline directly into the C2 loop, the compromised host is no longer a passive foothold but an autonomous operational asset."}],"system.lifecycle_stage":[{"source_index":0,"quote":"By embedding a live AI pipeline directly into the C2 loop, the compromised host is no longer a passive foothold but an autonomous operational asset."}],"system.integration_type":[{"source_index":0,"quote":"The JSON message is sent to the URL https:// api.openai.com/v1/chat/completions, the OpenAI Chat Completions endpoint, through an HTTP POST request."}],"system.intended_use":[{"source_index":0,"quote":"NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session."}],"event.summary":[{"source_index":0,"quote":"Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”"}],"event.agent_involved":[{"source_index":0,"quote":"By embedding a live AI pipeline directly into the C2 loop, the compromised host is no longer a passive foothold but an autonomous operational asset."}],"event.adversarial_actor":[{"source_index":0,"quote":"During our research, we observed that a threat actor hosted the NIK C2 framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”."}],"event.incident_class":[{"source_index":0,"quote":"NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session."}],"event.failure_class":[{"source_index":0,"quote":"If the WebSocket is not currently connected, the routine falls back to an HTTP POST request to the endpoint path /api/c2/result on the C2 server, using the same encrypted body format."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"| /api/c2/file_chunk | File exfiltration |"}],"event.root_cause":[{"source_index":0,"quote":"The implant C2 architecture is designed for two independent, simultaneously operating communication channels."}],"event.responsible_party":[{"source_index":0,"quote":"During our research, we observed that a threat actor hosted the NIK C2 framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”."}],"event.tags":[{"source_index":0,"quote":"Implant deploys screen-locking ransomware"}],"impact.affected_description":[{"source_index":0,"quote":"Browser databases, saved passwords, cookies, autofill, crypto wallets, Discord tokens, Firefox profiles."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Browser databases, saved passwords, cookies, autofill, crypto wallets, Discord tokens, Firefox profiles."}],"impact.severity_because":[{"source_index":0,"quote":"In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies."}],"context.shared_model_id":[{"source_index":0,"quote":"Decoding the five-character value showed gpt-4 confirming that GPT4 is the default when no model is specified."}],"context.systemic_exposure":[{"source_index":0,"quote":"AI Generate | Live OpenAI API inference routed through victim machine with actor prompts."}],"context.country":[{"source_index":0,"quote":"AI Generate | Live OpenAI API inference routed through victim machine with actor prompts."}],"context.industry":[{"source_index":0,"quote":"AI Generate | Live OpenAI API inference routed through victim machine with actor prompts."}],"impact.severity":[{"source_index":0,"quote":"In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-29"}]},"notes_on_gaps":"No source states event.date_occurred, event.date_disclosed, event.detection_method, event.duration, event.time_to_contain, event.date_detected, event.near_miss, event.operations_paused, event.remediation, event.precursor_events, event.input_provenance, event.root_cause_detail, event.failure_class_detail, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.remediation_hours, impact.loss_range_usd, impact.reversibility, impact.downstream_exposure_count, impact.protected_class_involved, context.org_size_band, context.denominator, context.regulatory, context.coverage, context.upstream_incident_id, context.incident_evidence, system.model_version, system.safeguard_state, system.production_intended, system.autonomy_level. system.autonomy_level left unknown: no source states the approval or monitoring arrangement for the AI calls. event.trigger human_misuse is classified from the actor deliberately issuing prompts; no source names an external cause in the injection sense. event.failure_class unauthorized_communication is classified from the implant's fallback HTTP POST to the C2 server; the AI client's own outbound call to OpenAI is the closer fit but no sentence states it as outside permitted scope. event.root_cause unknown: no source names what failed; the implant's AMSI bypass is an evasion technique, not a failed control. impact.severity major rests on live production compromise with unbounded scope; no loss figure stated. context.systemic_exposure false: the shared gpt-4 model is not the correlating component; each victim's own key funds inference. system.tier and event.date_disclosed are derived by rule and not written. event.trigger: human_misuse was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: enterprise by rule (operator Unnamed threat actor operating NIK C2 differs from developer OpenAI). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-29] system.permissions_scope: classified from described behaviour. system.lifecycle_stage: production. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.secondary_failure_classes: a source states data left the boundary it was meant to stay within by the agent's action. event.responsible_party: third_party. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. context.industry: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":"unknown","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":"gpt-4","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A threat actor's Go-based Windows implant, NIK C2, ran on compromised hosts with credential dumping, keylogging, screen and audio capture, lateral movement and an embedded OpenAI API client that sends actor prompts to the Chat Completions endpoint.","quote":"Notably, the NIK C2 implant embeds a fully integrated OpenAI API client via its ai_generate command, allowing operators to route arbitrary prompts to the OpenAI Chat Completions API directly through the infected host.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The implant stole victim data and, when no API key was supplied, used the victim's own OPENAI_API_KEY, charging the victim's account and attributing the requests to the victim rather than the actor.","quote":"If the victim has configured an OpenAI account on their machine, that account's API key will be used to fund the actor's AI inference.","source_index":0,"grade":"C"},{"step":"reached","text":"It reached the victim's browser databases, saved passwords, cookies, crypto wallets, Discord tokens, Wi-Fi passwords, keystrokes, screen, camera, microphone, clipboard and internal network via proxy and RDP pivoting.","quote":"Browser databases, saved passwords, cookies, autofill, crypto wallets, Discord tokens, Firefox profiles.","source_index":0,"grade":"C"},{"step":"caught","text":"Cisco Talos researchers observed the framework in the wild, including an active C2 server at 87.120.196[.]120 resolving total-sitevv[.]lol.","quote":"During our research, we observed that a threat actor hosted the NIK C2 framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”.","source_index":0,"grade":"C"},{"step":"done","text":"The chunk does not state containment, notification or remediation; it only advises defenders to adopt continuous behavioral vigilance.","quote":"Such AI-enabled adversarial frameworks require defenders to move beyond traditional detection and embrace continuous behavioral vigilance as the new baseline.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-29","source_urls":["https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/"]}}