Threat
NIK C2: The new AI-enabled command-and-control framework
First reported talosintelligence.com
Page published
Earliest dated coverage: 29 Oct 2026 · First observed: 29 Oct 2026 · Latest dated coverage: 29 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
NIK C2 integrates LLM-assisted analysis into active compromises, potentially shortening the interval between sensitive-data collection and exploitation while combining surveillance and ransomware capabilities.
Cisco Talos observed NIK C2, a Go-based Windows remote-access implant that integrates the OpenAI Chat Completions API through an ai_generate command, allowing operators to analyze harvested data within compromised sessions. The implant combines credential theft, keystroke collection, lateral-movement capabilities, resilient encrypted command-and-control, and screen-locking ransomware.