Talos reveals NIK C2 AI-driven implant and flags critical PHP KEV additions

1. Executive summary

Cisco Talos has published research on NIK C2, a Go-based 64-bit Windows implant that embeds an OpenAI API client in its command-and-control loop, letting operators run prompts through the infected host and return model output to the actor panel. The same Talos newsletter reports that CISA added two critical PHP remote code execution vulnerabilities to the Known Exploited Vulnerabilities catalog on Monday, and flags an out-of-bounds write in Google's Brotli decoder affecting Node.js, .NET, PowerShell and Python packages. No CVE identifiers, CVSS scores or KEV remediation dates are available for any of these items, so severity cannot be stated on a scored basis. For EMEA financial services the exposure is twofold: internet-facing PHP estates that are now known-exploited, and Windows endpoints where a credential-dumping, keystroke-streaming implant can use the victim's own OpenAI keys to blend inference traffic with legitimate SaaS use.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

NIK C2 is a 64-bit Windows remote access tool written in Go. Talos observed three implant versions in the wild, all compiled with Go 1.23.4, which places the sample set no earlier than late 2024. The embedded build path /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go shows the project name nik_panel and indicates cross-compilation for Windows from a Linux build host. PE TimeDateStamp fields are zeroed and filesystem timestamps are set near epoch (appearing as 29 November 1979) across all samples.

Command-and-control uses two channels: TLS-secured WebSockets on port 443, and an HTTP fallback polling loop every 250 milliseconds. Traffic is encrypted with AES-256-GCM using a key derived from a hardcoded seed. The implant resolves C2 through three tiers in priority order: runtime-updated URLs, an embedded encrypted server list, and a hardcoded fallback address. Talos observed one server at 87.120.196[.]120 resolving total-sitevv[.]lol, presenting a certificate with serial 7d16381a9de823943b5a0987dbd0f26edf22052b, JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b and Common Name nik-panel, which matches strings inside the binary.

The AI component is the architecturally distinct part. The implant implements an ai_generate command that builds an HTTP request to OpenAI's production inference endpoint, sends it from the victim's IP address, parses the JSON response and returns the generated text to the actor panel. The command payload carries three fields: prompt (the text to send), api_key (the OpenAI key used for authentication) and model (which model to call). A zero-length prompt causes the handler to return an error without any outbound call. The whole operation runs synchronously with a 60-second timeout. Because the request originates from the victim host and is funded by the victim's own key, the inference traffic is not attributable to actor infrastructure.

Capabilities Talos attributes to the implant include credential dumping, keystroke streaming, RDP session hijacking, process hollowing, surveillance and theft functions, and a C2-driven screen-lock ransomware module. Talos assesses with moderate confidence that NIK C2 is a functional framework rather than a proof of concept, based on observing live infrastructure.

The newsletter also carries three items with no technical detail beyond the headline. CISA added two PHP core remote code execution vulnerabilities to KEV on Monday; the newsletter does not name the CVE identifiers, the affected PHP versions or the remediation due date. A separate Talos post covers the same two PHP RCEs and states Snort coverage is available. An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell and Python packages and can lead to code execution; no CVE, version range or fix is given. Eight compromised eMudhra intermediate certificates were revoked, and eMudhra stopped issuing under its G3 root.

Confidence caveats. The NIK C2 technical detail is single-sourced to Cisco Talos. No MITRE ATT&CK profile is available for any actor behind NIK C2 and Talos names none, so attribution is unconfirmed. The PHP and Brotli items are headline-level only; treat the absence of CVE identifiers as a gap to close against the vendor advisories before acting.

4. Mitigation & containment

P1, within 24 hours. Inventory internet-facing PHP: enumerate installed versions on all web servers and application hosts, then apply the vendor fixes for the two KEV-listed RCEs as soon as the CVE identifiers and fixed versions are confirmed from the PHP project advisory. Where a host cannot be patched, put it behind a WAF with virtual patching and give the exception a named owner and a deadline. On Windows estates, hunt for the NIK C2 build path string /opt/nik_panel/ and the CN nik-panel in endpoint telemetry and TLS certificate logs, and block 87.120.196[.]120 and total-sitevv[.]lol at egress and DNS.

P2, within 72 hours. Restrict outbound HTTPS from servers and workstations that have no business need to reach api.openai.com, and alert on hosts whose OpenAI usage does not match a registered application or key owner. Rotate any OpenAI API keys held on endpoints that show unexplained inference traffic. Audit eMudhra-issued certificates in your TLS estate against the eight revoked intermediates and remove or replace any still in use.

P3, within 7 days. Identify Node.js, .NET, PowerShell and Python components that bundle the Brotli decoder and track the upstream fix once published. Add detection for the dual-channel C2 pattern: long-lived TLS WebSocket sessions on 443 to non-corporate destinations, plus high-frequency HTTP polling at roughly 250 millisecond intervals from the same process.

5. Indicators of compromise

The newsletter's hash block carries no descriptive context tying the samples to NIK C2; the example filenames are KMSAuto utilities and generic sample.exe, and the detection names are commodity hacktool verdicts. They are reproduced here as published, with that caveat.

The certificate serial is recorded as a sha1-length value because Talos publishes it as a 40-hex-character string; it is a serial number, not a file hash.

sha256  73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d
md5  0cf0271c3564881fce95f44c649bd745
sha256  9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
md5  2915b3f8b703eb744fc54c81f4a9c67f
sha256  7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
md5  cca616647db9370c88998ae25da6997f
sha256  58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
md5  f1fe671bcefd4630e5ed8b87c9283534
sha256  fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
md5  207d9d891ac756b2bfad88aba5682c65
ipv4  87.120.196[.]120
domain  total-sitevv[.]lol
ja3s  28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b
sha1  7d16381a9de823943b5a0987dbd0f26edf22052b

Behavioural indicators:

6. Detection

rule NIK_C2_Go_Implant
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-29"
        reference = "https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/"
        description = "Detects NIK C2 Go implant by embedded build path and AI command artefacts"
    strings:
        $build = "/opt/nik_panel/data/build_" ascii
        $panel = "nik_panel" ascii
        $aicmd = "ai_generate" ascii
        $f_prompt = "prompt" ascii wide
        $f_apikey = "api_key" ascii wide
        $f_model = "model" ascii wide
        $go = "Go build ID" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 50MB and
        ($build or $panel) and
        $aicmd and
        2 of ($f_*) and
        $go
}

title: NIK C2 dual-channel C2 network pattern
id: 8f3c2a71-4d6e-4b9a-9c1e-7a2f5b0d3e64
status: experimental
description: Detects a process holding a TLS WebSocket session on 443 to an external host while polling HTTP at roughly 250ms intervals, consistent with NIK C2 dual-channel C2
author: Adverse Trace
date: 2026-10-29
references:

  - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
logsource:
  category: network_connection
  product: windows
detection:
  selection_tls:
    DestinationPort: 443
    Initiated: 'true'
  selection_poll:
    DestinationPort: 80
  timeframe: 1m
  condition: selection_tls | count() by Image > 0 and selection_poll | count() by Image > 30
fields:

  - Image
  - DestinationIp
  - DestinationPort
falsepositives:

  - Applications with legitimate long-poll or WebSocket plus HTTP fallback behaviour
level: medium

The Sigma rule is a behavioural approximation: the 250 millisecond polling interval is not directly observable in standard network connection logs, so the count threshold is a proxy. Tune against baseline before enabling at block.

7. Sources

• Cisco Talos, "A quiet week in infosec <.<", https://blog.talosintelligence.com/a-quiet-week-in-infosec/, 2026-10-29
• Cisco Talos, "NIK C2: The new AI-enabled command-and-control framework", https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/, date not stated in the supplied extract

8. Adverse Trace position

No CVE, CVSS score, EPSS value or CISA KEV remediation date is available for any item in this advisory, so we are not assigning a severity band; the PHP KEV additions are the most time-sensitive element and should be actioned against the PHP project advisory as soon as the CVE identifiers are confirmed. The NIK C2 research is single-sourced to Cisco Talos and the actor is unattributed, so the IOCs in §5 should be verified before enforcement and treated as hunting leads rather than blocklist entries; the newsletter hash block in particular has no stated link to NIK C2. We will obtain the CVE identifiers and fixed versions for the two PHP RCEs and the Brotli decoder flaw, reissue this advisory with scored severity and KEV due dates, and extend the NIK C2 detection set once independent reporting corroborates the C2 infrastructure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.