Talos describes "NIK C2" (project name nik_panel), a 64-bit Go implant with more than 52 commands: browser credential and cookie theft, Wi-Fi passwords, Discord tokens, desktop and extension crypto wallets, a live keylogger, screen/camera/mic capture, hidden VNC, SOCKS and reverse-proxy pivoting, and a screen-locking ransomware module that does not encrypt files.

• AI feature: an ai_generate command posts the operator's prompt to api.openai.com/v1/chat/completions from the victim's machine. If the operator supplies no key, it reads the victim's OPENAI_API_KEY environment variable, so the victim pays and the logs point at the victim. Default model string gpt-4.
• Network: TLS WebSocket on 443 plus HTTP fallback polling about every 250 ms to /api/c2/update, /api/c2/result, /api/c2/screen, /api/c2/file_chunk, /api/c2/ws. Live server seen at 87.120.196[.]120 / total-sitevv[.]lol with a TLS certificate whose CN is nik-panel.
• Host: copies into %AppData%\Roaming\Microsoft\Network, Run-key persistence, masquerades as svchost.exe / simvol.exe / csrss.exe, sets itself critical (killing it blue-screens the host), fodhelper UAC bypass, AMSI patch. Lock-screen stage writes lock_screen.html and lock_start.bat to %TEMP%, adds Run value SystemLock, loops mshta.exe, and copies the MBR to mbr_backup.bin; bootkit prep drops bootkit.bin containing "NIK_BOOTKIT_PREP".

Hunt: outbound connections to api.openai.com from hosts or processes that have no reason to call it; Run value SystemLock; mshta.exe launched repeatedly from a .bat in %TEMP%; reads of \\.\PhysicalDrive0 by PowerShell. Talos publishes full IOCs on GitHub; ClamAV: Win.Trojan.GoDiscorder-10060526-0. Keep API keys out of user environment variables on endpoints.