Search — “systemlock”

Cisco Talos documented NIK C2, a Go-based Windows RAT observed live in the wild (C2 at 87.120.196[.]120 / total-sitevv[.]lol). It steals browser credentials, Wi-Fi keys, crypto wallets and keystrokes, and can relay actor prompts to the OpenAI Chat Completions API using the victim's OPENAI_API_KEY if one is set. It persists via HKCU Run keys and a copy in %appdata%\Microsoft\Network, bypasses UAC via a fodhelper ms-settings hijack, patches AMSI, and can deploy an mshta-based screen-locker. Hunt for netsh wlan key=clear, chcp 65001 recon chains, mshta launching lock_screen.html, a SystemLock Run key, bcdedit /enum plus Confirm-SecureBootUEFI, and unexpected api.openai.com traffic from non-developer hosts.

Talos observed NIK C2, an AI-integrated C2 framework with a Go-based Windows implant, active in the wild (server 87.120.196[.]120 / total-sitevv[.]lol). The implant steals browser credentials, Wi-Fi passwords, crypto wallets and Discord tokens, streams keystrokes, and proxies into internal networks. It can also route prompts to the OpenAI Chat Completions API from the victim, using the victim's OPENAI_API_KEY if present, and deploy mshta-based screen-lock ransomware. Hunt for netsh wlan key=clear, chcp 65001-prefixed recon, the fodhelper ms-settings COM hijack, the SystemLock Run key, mshta lock_screen.html, MBR reads of \\.\PhysicalDrive0, and /api/c2/* HTTP endpoints.