TOPIC
NIK C2 framework identity, technical capability, observed infrastructure, victim/delivery scale, actor attribution, infrastructure continuity and whether integrated AI creates demonstrated operational advantage.
1
4
2
7
2
NEW — functional AI-integrated Windows C2 framework, original in-the-wild infrastructure and independently verified public sample telemetry established; current backend continuity, victim scale, delivery chain, actor attribution and NIK-specific AI outcome advantage remain unproven.
MALWARE_CAMPAIGN_RESEARCH_TOPIC
—
—
—
NIK C2 is a functional AI-integrated Windows C2 framework observed with active infrastructure in the wild.
Independent sample telemetry recovered; incident artifacts, delivery chain, victim telemetry and campaign denominator remain missing.
The post-publication total-sitevv.lol state remains operationally connected to the same NIK C2 backend/campaign observed by Talos.
Passive DNS/origin mapping, matching operational certificate/endpoint behavior or provider telemetry.
A single identifiable actor/team can currently be attributed as the operator/developer responsible for the observed NIK C2 activity.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 4 Evidence
Talos observed NIK C2 as a functional Go-based Windows C2/implant with credential theft, surveillance, remote-control/lateral movement, evasion, screen-locking ransomware and an integrated AI request path; active NIK C2 infrastructure was observed during research.
لا يثبت: Victim count, delivery chain, campaign prevalence, actor identity, MENA targeting or measured AI outcome advantage.
فتح Run المصدرPublic scanner/VirusTotal-derived records on 2026-10-30/31 showed total-sitevv.lol behind Cloudflare edges with multiple malicious/suspicious vendor verdicts, supporting malicious reputation and post-publication infrastructure drift.
لا يثبت: Original backend continuity, active NIK C2 sessions, victimization or actor identity.
فتح Run المصدرGTIG/Mandiant observed multiple threat actors using agentic offensive frameworks in incident-response engagements, independently establishing broader live adversarial LLM/agentic framework use in 2026.
لا يثبت: NIK C2 deployment, victims, actor identity or NIK-specific AI efficacy.
فتح Run المصدرMalwareBazaar lists representative SHA-256 0fb93dbb9525004f9e5b1ee4bcd6b6638700bee576413e955c8c96292fa964ee as NIKRAT with repository ingest on 2026-10-30; the same record embeds Kaspersky OpenTIP and ReversingLabs first-seen telemetry from 2026-08-12 plus malicious/suspicious verdicts, and some enrichment labels the family NIK C2.
لا يثبت: Victim infections, delivery chain, campaign scale, actor identity, or independence of every family label from later public reporting.
فتح Run المصدرActor-linked infrastructure, handles, build/repository provenance or authoritative attribution.
NIK C2's integrated AI path materially improves operational speed or attack success compared with equivalent non-AI workflows.
Measured incident timelines, operator telemetry, controlled comparison or repeatable outcomes.
Yoba is a documented Windows malware distribution campaign using fake AI-themed GitHub lures and signed-binary DLL sideloading.
Independent EDR/IR victim telemetry and replacement/current infrastructure.
Agentic offensive frameworks are in active real-world use by multiple distinct threat actors/campaigns and can autonomously execute meaningful multi-stage intrusion actions.
Additional independent victim/IR telemetry for broader prevalence.
Agentic/LLM-driven offensive frameworks materially increase end-to-end attack success probability versus equivalent competent human/non-AI workflows.
Controlled/matched baseline controlling for credentials, vulnerabilities, operator skill, ordinary automation and target exposure.
Confirmed victim count/list, delivery or initial-access chain, prevalence denominator and campaign scale for NIK C2 remain missing; independent public sample telemetry is now recovered.
Incident-response artifacts, victim telemetry, distribution-chain evidence or authoritative campaign reporting.
Actor attribution and direct continuity between Talos's observed NIK C2 backend and the current Cloudflare-fronted total-sitevv.lol state remain unresolved.
Passive DNS/origin history, matching certificate/endpoint telemetry, hosting records, operator artifacts or authoritative attribution.