[nik-c2]

October 30, 2026

• Talos found NIK C2 in the wild: a Go-based 64-bit Windows implant with dual-channel C2 (TLS WebSockets on 443 plus a 250 ms HTTP polling fallback, AES-256-GCM from a hardcoded seed, three prioritised C2 tiers), credential dumping, keystroke streaming, RDP session hijacking, process hollowing and a screen-lock ransomware module — plus an ai_generate command that routes prompts to the OpenAI Chat Completions API from the infected host, using operator or victim keys. All samples were built with Go 1.23.4 or later, and live infrastructure led Talos to assess with moderate confidence that it is a working framework, not a PoC (Talos). · AI & Model Security

in Attackers Go for the Management Plane