Kiberxavfsizlik yangiliklari
2 daqiqa o'qish
Yangi sun'iy intellekt bilan ishlaydigan NIK C2 zararli dasturi OpenAI API'dan foydalanib xakerlarga ma'lumotlarni o'g'irlash va Windows kompyuterlarini boshqarishda yordam beradi
Muallif: Kavichselvan
30-oktabr, 2026-yil
Cisco Talos NIK C2 ni aniqladi — bu Go tilida yozilgan, 64-bitli Windows masofaviy kirish vositasi bo'lib, u ishlaydigan OpenAI mijozini o'z ichiga oladi.
Operatorlar zararlangan mashina orqali so'rov yuborishi va modelning javoblarini o'zlarining C2 panelida o'qishi mumkin.
NIK C2 zararli dasturi
Cisco Talos tomonidan e'lon qilingan texnik tadqiqotga ko'ra, implant server bilan TLS bilan himoyalangan WebSockets orqali 443-portda bog'lanadi. Shuningdek, u har 250 millisekundda so'rov yuboradigan HTTP zaxira aylanishini ham ishlatadi.
Barcha trafik AES-256-GCM bilan shifrlanadi, kalit esa qattiq kodlangan urug'dan hosil qilinadi. Uchta ustuvor C2 darajasi uning o'chirilishiga chidamliligini ta'minlaydi: ish vaqti davomida yangilanadigan URL manzillari, shifrlangan server ro'yxati va qattiq kodlangan zaxira manzil.
Talos 87.120.196[.]120 manzilida jonli serverni ko'rdi, u total-sitevv[.]lol domeniga yo'naltirilgan. Uning sertifikati "nik-panel" umumiy nomidan foydalangan. Bu tadqiqotchilarni o'rtacha ishonch bilan bu funksional tizim ekanligiga, isbotlanmagan kontsept emasligiga ishontirdi.
NIK C2 Evolyutsiya xronologiyasi (Rasm manbasi: Talosintelligence)
aigenerate buyrug'i so'rov, ixtiyoriy API kaliti va ixtiyoriy model nomini qabul qiladi. Agar operator kalit taqdim etmasa, implant jabrlanuvchining OPENAIAPI_KEY muhit o'zgaruvchisini o'qiydi.
Shunda jabrlanuvchining hisobi hisob-kitobni to'laydi va OpenAI jurnallari hujumchini emas, balki jabrlanuvchini ko'rsatadi. Standart model — gpt-4. So'rovlar Chat Completions nuqtasiga 60 soniyalik kutish vaqti bilan yuboriladi.
Bu MalTerminal va x47.c kabi sun'iy intellekt bilan boshqariladigan botnetlar kabi LLM bilan ishlaydigan zararli dasturlarning o'sib borayotgan namunasiga mos keladi.
Dispetcher 52 dan ortiq buyruqni boshqaradi. Ular brauzer ma'lumotlarini, Discord tokenlarini, Wi-Fi parollarini, kripto hamyonlarini va urug' iboralarini o'g'irlashni, klaviatura kuzatuvchisi, ekran tasviri, kamera va audio orqali kuzatuvni, clipboard kuzatuvini, yashirin VNC, SOCKS5 va teskari proksi, shuningdek RDP operatsiyalari orqali masofaviy boshqaruv va yonma-yon harakatni, shuningdek, ro'yxatga olish kalitlari va kuzatuv jarayoni orqali doimiylikni o'z ichiga oladi.
Ransomware moduli Master Boot Record nusxasini zaxiralaydi. So'ngra u Bitcoin va USDT talablarini o'z ichiga olgan HTML qulflash ekranini yaratadi va uni mshta.exe orqali ishga tushiradi. Agar foydalanuvchi uni yopsa, partiya aylanishi ekranini besh soniya ichida qayta ochadi. Modul hech qanday faylni shifrlamaydi.
Alohida bootkit tayyorlash tartibi UEFI yoki BIOS va Secure Boot holatini tekshiradi. So'ngra u "bootkit.bin" nomli joylashtirish faylini yozadi.
NIK C2 Operatsion arxitekturasi (Rasm manbasi: Talosintelligence)
Implant o'zini csrss.exe deb qayta nomlaydi, o'zini muhim jarayon deb belgilaydi, shuning uchun uni tugatish Moviy Ekran O'limiga (BSOD) olib keladi, disk raskadrovka dasturini aniqlaganda jimgina chiqadi, fodhelper.exe o'g'irlash orqali UAC ni chetlab o'tadi va PowerShell'da AMSI ni tuzatadi.
ClamAV tahdidni Win.Trojan.GoDiscorder-10060526-0 sifatida aniqlaydi. Himoyachilar yuqoridagi C2 domeni va IP manziliga trafikni, SystemLock ro'yxatga olish kalitini, temp katalogidagi lockstart.bat va lockscreen.html fayllarini va oxirgi nuqtalardan api.openai.com ga kutilmagan chiquvchi chaqiruvlarni kuzatishi kerak.
Shuningdek, ular har qanday ochiq AI API kalitlarini aylantirishi kerak. Talos bunday tizimlar doimiy xulq-atvor kuzatuvini talab qilishini ta'kidlaydi, chunki ular to'plash va ekspluatatsiyani bitta sessiyada birlashtiradi.
Teglar Kiberxavfsizlik yangiliklari
Kavichselvan
Bu hafta issiq
Cyber Security News
2 min.Read
New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs
By Kavichselvan
October 30, 2026
Share FacebookTwitterPinterestWhatsApp
Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client.
Operators can send prompts through an infected machine and read the model’s replies in their C2 panel.
NIK C2 malware
According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured WebSockets on port 443. It also runs an HTTP fallback loop that polls every 250 milliseconds.
All traffic uses AES-256-GCM with a key derived from a hardcoded seed. Three prioritized C2 tiers help it survive takedowns: runtime-updated URLs, an embedded encrypted server list and a hardcoded fallback address.
Talos saw a live server at 87.120.196[.]120, which resolved to total-sitevv[.]lol. Its certificate used the common name “nik-panel”. That convinced researchers, with moderate confidence, that this is a functional framework and not a proof of concept.
NIK C2 Evolution Timeline (Image Source: Talosintelligence)
The aigenerate command takes a prompt, an optional API key and an optional model name. If the operator supplies no key, the implant reads the victim’s OPENAIAPI_KEY environment variable.
The victim’s account then pays for the inference, and OpenAI’s logs point to the victim, not the attacker. The default model is gpt-4. Requests go to the Chat Completions endpoint with a 60-second timeout.
This fits a growing pattern of LLM-enabled malware such as MalTerminal and AI-driven botnets like x47.c.
The dispatcher handles more than 52 commands. They cover theft of browser credentials, Discord tokens, Wi-Fi passwords, crypto wallets and seed-phrase files, surveillance via a keylogger, screen capture, camera and audio, and clipboard monitoring, remote control and lateral movement through hidden VNC, SOCKS5 and reverse proxies, and RDP operations, as well as persistence using registry Run keys and a watchdog process.
The ransomware module backs up the Master Boot Record. It then builds an HTML lock screen with Bitcoin and USDT demands and launches it through mshta.exe. A batch loop reopens the screen within five seconds if the user closes it. The module encrypts no files.
A separate bootkit-preparation routine checks for UEFI or BIOS and the Secure Boot state. It then writes a placeholder file named “bootkit.bin”.
NIK C2 Operational Architecture (Image Source: Talosintelligence)
The implant renames itself to csrss.exe, marks itself as a critical process so terminating it triggers a Blue Screen of Death, exits silently when it detects a debugger, bypasses UAC through a fodhelper.exe hijack, and patches AMSI in PowerShell.
ClamAV detects the threat as Win.Trojan.GoDiscorder-10060526-0. Defenders should watch for traffic to the C2 domain and IP above, the SystemLock Run key, lockstart.bat and lockscreen.html in the temp directory, and unexpected outbound calls to api.openai.com from endpoints.
They should also rotate any exposed AI API keys. Talos notes that such frameworks demand continuous behavioral monitoring, since they collapse collection and exploitation into a single session.
Tags Cyber Security News
Kavichselvan
Hot this week
Infosec- Resources How To Access Dark Web Anonymously and know its Secretive and Mysterious Activities
June 4, 2023 1
What is Deep Web
The deep web, invisible web, or...
SOC Architecture How to Build and Run a Security Operations Center (SOC Guide) – 2023
June 3, 2023 12
Today’s Cyber security operations center (CSOC) should have everything...
Cyber Security News Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component
October 18, 2023 0
TeamViewer's popularity and remote access capabilities make it an...
Checklist Web Server Penetration Testing Checklist – 2026
January 6, 2026 0
Web server pentesting is performed under three significant categories: identity,...
Infosec- Resources ATM Penetration Testing – Advanced Testing Methods to Find The Vulnerabilities
June 4, 2023 4
ATM Penetration testing, Hackers have found different approaches to...
Topics
Acquisition Adobe Adware AI Amazon Amazon AWS AMD Android Anti Virus Antimalware ANY RUN Apache API Apple APT Artificial Intelligence Avast AWS Azure Backdoor Bitcoin Bluetooth Botnet Browser Buffer over flow Bug Bounty Business Chatbots ChatGPT Checklist Chrome Cisco CISO CISO Advisory Cloud Cloud Security Cloudflare Computer Security Course CPU Cross site Scripting cryptocurrency Cryptocurrency hack CVE/vulnerability Cyber Advisory Cyber AI Cyber Attack Cyber Crime cyber security Cyber security Course Cyber Security News Cyber Security Resources Cybersecurity Newsletter Dark Web Data Breach Data Governance DDOS Deals DeepSeek Discord DNS Dos Attack Drive Dropbox Education Email Email Security Ethical Hacking Exploit Exploitation Tools Extratorrents FACEBOOK Featured Firefox Firefox News Firewall Forensics Tools game GenAI GitHub GitLab Gmail Google Google dorks Governance GRC Hacking Books Hacks Hardware Hacking HBO HTML HTTP IBM IIS Incident Response Information Gathering Information Security Risks Infosec- Resources Insider Threats Instagram More
Cyber Security News Claude AI Exposes Internal Sandbox Details That Help Researcher Bypass Local Connection Restrictions
0
A Bishop Fox researcher investigating Claude’s sandbox obtained an...
AI Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access
0
A trojanized version of the Claude Code extension, identified...
Cyber Security News 12 Incident Response Retainer Services: The 2026 Buyer’s Verdict Guide
0
A retainer is a contract you buy hoping to...
Cyber Security News 12 Digital Forensics & Incident Response (DFIR) Companies: The 2026 Buyer’s Verdict Guide
0
You retain a DFIR firm for the breach you’ll...
Cyber Security News 12 Managed SIEM Services: The 2026 Buyer’s Verdict Guide
0
Managed SIEM’s quiet failure is dependency: two years in,...
Cyber Security News 11 SOC-as-a-Service Providers: The 2026 Buyer’s Verdict Guide
0
SOCaaS is bought on the 3 a.m. question what...
Cyber Security News 12 Managed Security Service Providers (MSSP): The 2026 Buyer’s Verdict Guide
0
Choosing an MSSP is choosing a relationship model pure-play...
CVE/vulnerability WordPress 7.1.4 Fixes 22 Security Vulnerabilities, Including RCE Flaw Under Active Attack
0
WordPress released version 7.1.4 on October 28, 2026, which...
Related Articles
Claude AI Exposes Internal Sandbox Details That Help Researcher Bypass Local Connection Restrictions
Cyber Security News
October 30, 2026
Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access
AI
October 30, 2026
12 Incident Response Retainer Services: The 2026 Buyer’s Verdict Guide
Cyber Security News
October 30, 2026
12 Digital Forensics & Incident Response (DFIR) Companies: The 2026 Buyer’s Verdict Guide
Cyber Security News
October 30, 2026
12 Managed SIEM Services: The 2026 Buyer’s Verdict Guide
Cyber Security News
October 30, 2026
Recent News
Claude AI Exposes Internal Sandbox Details That Help Researcher Bypass Local Connection Restrictions
Kavichselvan - October 30, 2026
Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access
Divya - October 30, 2026
12 Incident Response Retainer Services: The 2026 Buyer’s Verdict Guide
Swathika - October 30, 2026
12 Digital Forensics & Incident Response (DFIR) Companies: The 2026 Buyer’s Verdict Guide
Swathika - October 30, 2026
12 Managed SIEM Services: The 2026 Buyer’s Verdict Guide
Swathika - October 30, 2026
11 SOC-as-a-Service Providers: The 2026 Buyer’s Verdict Guide
Swathika - October 30, 2026