Cisco Talos published an analysis on 29 October, by Chetan Raghuprasad, of a command-and-control framework it calls NIK C2. The core is a Go-based 64-bit Windows implant, and Talos describes it as "fully functional" rather than a demonstration, though it holds that at moderate confidence.

It has an ai_generate command, which sends an operator's prompt to the OpenAI Chat Completions API from the infected machine and returns the answer over the C2 channel. That on its own would be a footnote. The detail underneath it is not.

Who pays for the inference

The operator can supply an API key and a model name. If no key is supplied, the implant reads OPENAI_API_KEY from the victim's own environment.

The inference is then billed to the victim, the provider's logs point at the victim's key, and the operator spends nothing and leaves no account of their own to subpoena. Each call carries a hardcoded 68-byte system prompt and a 60-second timeout, so it bills like ordinary usage on somebody else's account.

The usual objection to model-assisted intrusion is that it costs money and leaves a paper trail at the provider. The victim's machine is often already holding both. The default model decodes to gpt-4, and an operator can name another without rebuilding the implant.

The AI is one command in a long list

Strip the model out and this is still a complete remote access tool. Transport is TLS WebSockets on port 443 with an HTTP polling fallback every 250 milliseconds, traffic encrypted with AES-256-GCM from a hardcoded seed, and 3 prioritised C2 tiers so losing one does not lose the implant.

It takes browser credentials, cookies and saved data, Discord tokens, cryptocurrency wallets both desktop and browser-extension, and Wi-Fi passwords, and it searches the filesystem for seed-phrase and private-key files. It keylogs, captures the screen, reaches the camera and microphone, and watches the clipboard. For movement it carries a SOCKS5 and HTTP proxy, reverse proxy tunnels and RDP operations.

Persistence is registry Run keys, process masquerading and a watchdog that restarts the agent. Evasion includes AMSI patching, an anti-debug check that exits silently, a fodhelper UAC bypass, and a flag that marks the process critical, so killing it takes the machine down with it. That last one is worth knowing before an incident responder reaches for task manager.

The ransomware module does not encrypt anything

There is a screen locker. It backs up the master boot record, displays an HTML lock screen through mshta.exe, persists under a Run key named SystemLock, and demands Bitcoin or USDT in amounts the operator sets. No files are encrypted.

Alongside it sits a bootkit preparation module that checks whether the machine is UEFI or BIOS and whether Secure Boot is on, then stages a placeholder file. Preparation, not a bootkit.

Talos does not say whether either module has been used against anyone, or whether any payment has been made.

Where the evidence stops

The post's conclusion suggests operators could generate lure material, craft payloads and synthesise intelligence on the host. What it shows is the API integration that would allow that. The distinction has been the week's recurring theme, from Trend Micro's Japanese cases to the firewall operation where the researchers said plainly that they had no direct evidence AI wrote anything.

Talos also names no operator, no victims, no sectors and no delivery method. The timeline comes from open-source sighting dates rather than confirmed deployments, and all samples were compiled with Go 1.23.4, which puts them no earlier than late 2024.

What to do

  • Take the detection Talos published: the ClamAV signature for the implant, and the indicators in its GitHub repository under 2026/10.
  • Alert on outbound connections to model APIs from machines that have no business making them. A finance workstation calling an inference endpoint is a finding on its own, whatever made the call.
  • Treat an API key in an environment variable as a credential, because this framework does. Scope keys down, set spending limits, and turn on usage alerts: an unexplained bill is now an intrusion signal.
  • Watch for a process marked critical before anybody tries to kill one. The crash is the point.
  • Remember that a locked screen here does not mean encrypted files. Pulling the disk and reading it elsewhere is likely to work, and paying is likely to buy nothing.

What is not established

  • Who wrote or operates it. Talos says only that the developers look like a team with prior malware experience.
  • Who has been attacked with it, in what sector, or how it gets onto a machine in the first place.
  • Whether the AI features have been used for anything beyond the integration Talos found in the code.
  • Whether it is sold, shared or private, and at what price.
  • Whether the screen locker or the bootkit staging has ever run outside a lab.
  • How current the picture is. The server was assessed as live at moderate confidence, and the versions were dated from sightings rather than from telemetry.