---
title: Hunt: NIK C2, a Go Windows RAT seen in the wild that can send operator prompts to OpenAI using the victim's own OPENAI_API_KEY, steal wallets and lock the screen for ransom | ctxsec
url: https://ctxsec.com/items/hunt-talos-nik-c2-go-implant-openai-api-screenlocker
description: ""
status: "vendor research (Cisco Talos, Oct 29); live C2 observed; no attribution"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-talos-nik-c2-go-implant-openai-api-screenlocker.md)

vendor research (Cisco Talos, Oct 29); live C2 observed; no attribution

2026-10-29

### Hunt: NIK C2, a Go Windows RAT seen in the wild that can send operator prompts to OpenAI using the victim's own OPENAI_API_KEY, steal wallets and lock the screen for ransom

Talos describes "NIK C2" (project name `nik_panel`), a 64-bit Go implant with more than 52 commands: browser credential and cookie theft, Wi-Fi passwords, Discord tokens, desktop and extension crypto wallets, a live keylogger, screen/camera/mic capture, hidden VNC, SOCKS and reverse-proxy pivoting, and a screen-locking ransomware module that does not encrypt files.

- **AI feature:** an `ai_generate` command posts the operator's prompt to `api.openai.com/v1/chat/completions` from the victim's machine. If the operator supplies no key, it reads the victim's `OPENAI_API_KEY` environment variable, so the victim pays and the logs point at the victim. Default model string `gpt-4`.
- **Network:** TLS WebSocket on 443 plus HTTP fallback polling about every 250 ms to `/api/c2/update`, `/api/c2/result`, `/api/c2/screen`, `/api/c2/file_chunk`, `/api/c2/ws`. Live server seen at 87.120.196[.]120 / total-sitevv[.]lol with a TLS certificate whose CN is `nik-panel`.
- **Host:** copies into `%AppData%\Roaming\Microsoft\Network`, Run-key persistence, masquerades as svchost.exe / simvol.exe / csrss.exe, sets itself critical (killing it blue-screens the host), fodhelper UAC bypass, AMSI patch. Lock-screen stage writes `lock_screen.html` and `lock_start.bat` to %TEMP%, adds Run value `SystemLock`, loops mshta.exe, and copies the MBR to `mbr_backup.bin`; bootkit prep drops `bootkit.bin` containing "NIK_BOOTKIT_PREP".

**Hunt:** outbound connections to api.openai.com from hosts or processes that have no reason to call it; Run value SystemLock; mshta.exe launched repeatedly from a .bat in %TEMP%; reads of `\\.\PhysicalDrive0` by PowerShell. Talos publishes full IOCs on GitHub; ClamAV: Win.Trojan.GoDiscorder-10060526-0. Keep API keys out of user environment variables on endpoints.

Sources: [Cisco Talos: NIK C2, the new AI-enabled command-and-control framework (Oct 29)](https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/)