{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries are collapsing the time between compromise and exfiltration by using AI to automate data analysis. A negative result confirms your web infrastructure is not a node in this high-velocity attack chain."
      },
      "name": "AI-Enhanced C2 and Web Proxy Hijacking",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1071.001",
        "attack.t1090",
        "attack.t1566",
        "attack.t1486",
        "command and control",
        "credential access",
        "execution",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "a-quiet-week-in-infosec",
        "index": 2,
        "title": "A quiet week in infosec <.<",
        "total": 2
      },
      "related": [
        {
          "hunt": "php-node-rce-behavioral-monitoring",
          "reason": "This hunt focuses on the network behavior of the post-exploit implant; a separate hunt should monitor process-level exploitation of the interpreters.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "ai-driven-nik-c2-implant-theft",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single rule for AI API traffic would drown an analyst in noise. This hunt uses the context of vulnerable web software to focus network behavioral analysis, pivoting between software inventory, rare DNS, and API volume to find hidden implants.",
      "coverage": [
        {
          "stage": "initial-access-exploitation",
          "steps": [
            "identify-web-asset-inventory"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control-ai",
          "steps": [
            "rare-dns-from-interpreters",
            "anomalous-ai-api-requests"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-implant-deployment",
          "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-theft",
          "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-ransomware-deployment",
          "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Applications",
            "slug": "initial-access-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1566"
            ],
            "observables": [
              "Exploitation of PHP core RCE vulnerabilities",
              "Exploitation of Node.js/Brotli decoder flaws",
              "Phishing emails targeting AI credentials"
            ]
          },
          {
            "name": "NIK C2 Implant Execution",
            "slug": "execution-implant-deployment",
            "tactic": "execution",
            "techniques": [
              "T1059.001"
            ],
            "observables": [
              "Go-based Windows implant execution",
              "Unexpected PowerShell executions",
              "Process names: KMSAuto++.exe, KMSAuto Net.exe"
            ]
          },
          {
            "name": "Credential and Data Harvesting",
            "slug": "credential-access-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1003"
            ],
            "observables": [
              "Unauthorized access to browser databases",
              "Access to crypto wallets",
              "Credential dumping from memory",
              "Keystroke streaming"
            ]
          },
          {
            "name": "AI-Enhanced Command and Control",
            "slug": "command-and-control-ai",
            "tactic": "command-and-control",
            "techniques": [
              "T1071.001",
              "T1090"
            ],
            "observables": [
              "Unusual local proxy routing",
              "Hijacked OpenAI API keys used for outbound C2 communication",
              "Go-based implant network activity"
            ]
          },
          {
            "name": "Screen-locking Ransomware",
            "slug": "impact-ransomware-deployment",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Deployment of screen-locking ransomware",
              "Data encryption for impact"
            ]
          }
        ],
        "summary": "The NIK C2 framework is a Go-based Windows implant that leverages integrated AI models to analyze harvested data in real-time. The campaign involves credential dumping, keystroke streaming, and the deployment of screen-locking ransomware, while masking infrastructure by hijacking victims' OpenAI API keys for data processing."
      },
      "severity": "high",
      "rationale": "Focus on internet-facing servers running PHP or Node.js. Use the software inventory to prioritize those that cannot be immediately patched.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited PHP or Node.js vulnerabilities to deploy a Go-based implant that hides its command-and-control activity by hijacking AI API keys and using local proxies.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the investigation."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "ai_api_domains": {
          "from": {
            "ref": "Cisco Talos - NIK C2",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[domain]",
          "default": [
            "api.openai.com",
            "api.anthropic.com",
            "api.cohere.ai",
            "api.groq.com"
          ],
          "description": "Known AI service API endpoints that may be targeted for key hijacking."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/a-quiet-week-in-infosec/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/a-quiet-week-in-infosec/",
          "name": "Cisco Talos \u2014 A quiet week in infosec"
        }
      ],
      "blind_spots": [
        {
          "id": "encrypted-ai-payloads",
          "risk": "Without payload inspection, legitimate AI developer traffic may mask C2 communication perfectly.",
          "stage": "command-and-control-ai",
          "question": "whether an AI API request contains stolen credentials or command responses",
          "requires": "hb_http_activity with request body capture"
        },
        {
          "id": "short-lived-proxies",
          "risk": "Snapshot-based socket tools like osquery may miss temporary proxy listeners used by the NIK C2 implant.",
          "stage": "command-and-control-ai",
          "question": "whether a local proxy was opened and closed rapidly between polling intervals",
          "requires": "hb_network_listener with real-time bind events"
        }
      ]
    },
    "name": "AI-Enhanced C2 and Web Proxy Hijacking",
    "description": "This hunt identifies compromised web assets by starting with the presence of PHP and Node.js engines, then fanning out to look for anomalous network behaviors. It specifically targets the NIK C2 pattern where the attacker hijacks legitimate OpenAI API keys to mask exfiltration and uses local proxy routing to blend into encrypted traffic. An agent triages the intersection of vulnerable software and rare outbound network signals."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "a-quiet-week-in-infosec",
          "index": 2,
          "title": "A quiet week in infosec <.<",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-exploitation",
            "steps": [
              "identify-web-asset-inventory"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control-ai",
            "steps": [
              "rare-dns-from-interpreters",
              "anomalous-ai-api-requests"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-implant-deployment",
            "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-theft",
            "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-ransomware-deployment",
            "reason": "Belongs to another part of the 'A quiet week in infosec <.<' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has exploited PHP or Node.js vulnerabilities to deploy a Go-based implant that hides its command-and-control activity by hijacking AI API keys and using local proxies.",
        "blind_spots": [
          {
            "id": "encrypted-ai-payloads",
            "risk": "Without payload inspection, legitimate AI developer traffic may mask C2 communication perfectly.",
            "stage": "command-and-control-ai",
            "question": "whether an AI API request contains stolen credentials or command responses",
            "requires": "hb_http_activity with request body capture"
          },
          {
            "id": "short-lived-proxies",
            "risk": "Snapshot-based socket tools like osquery may miss temporary proxy listeners used by the NIK C2 implant.",
            "stage": "command-and-control-ai",
            "question": "whether a local proxy was opened and closed rapidly between polling intervals",
            "requires": "hb_network_listener with real-time bind events"
          }
        ],
        "scoping_notes": "Focus on internet-facing servers running PHP or Node.js. Use the software inventory to prioritize those that cannot be immediately patched.",
        "beyond_detection": "A single rule for AI API traffic would drown an analyst in noise. This hunt uses the context of vulnerable web software to focus network behavioral analysis, pivoting between software inventory, rare DNS, and API volume to find hidden implants."
      }
    },
    {
      "id": "identify-web-asset-inventory",
      "type": "query",
      "label": "Identify PHP and Node.js assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%node%')",
        "surface": "hb_software_inventory",
        "description": "Find hosts running the web engines mentioned in the threat research to scope the behavioral queries.",
        "expected_signal": "A list of hosts running PHP or Node.js. Silence means no such engines are recorded in the inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify PHP and Node.js assets",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%node%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running PHP or Node.js. Silence means no such engines are recorded in the inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "rare-dns-from-interpreters",
      "type": "query",
      "label": "Rare DNS from web interpreters",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (LOWER(process_name) LIKE '%php%' OR LOWER(process_name) LIKE '%node%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING hosts <= 3 ORDER BY hosts ASC",
        "surface": "hb_dns_activity",
        "description": "Find rare domains queried by PHP or Node processes, which may indicate C2 infrastructure.",
        "expected_signal": "DNS queries to rare domains originating from web engine processes. Normal noise includes updates and legitimate API integrations."
      },
      "parents": [
        {
          "id": "identify-web-asset-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare DNS from web interpreters",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (LOWER(process_name) LIKE '%php%' OR LOWER(process_name) LIKE '%node%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING hosts <= 3 ORDER BY hosts ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "DNS queries to rare domains originating from web engine processes. Normal noise includes updates and legitimate API integrations.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "anomalous-ai-api-requests",
      "type": "query",
      "label": "Anomalous AI API requests",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE instr(',' || '{{ai_api_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path, user_agent",
        "surface": "hb_http_activity",
        "description": "Identify hosts talking to AI service APIs, which may indicate hijacked keys used for NIK C2 communication.",
        "expected_signal": "HTTP requests to AI provider domains. Any row on a server not explicitly designed for AI development is suspicious."
      },
      "parents": [
        {
          "id": "identify-web-asset-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Anomalous AI API requests",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE instr(',' || '{{ai_api_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path, user_agent",
        "silence": "not_evidence_of_absence",
        "expected": "HTTP requests to AI provider domains. Any row on a server not explicitly designed for AI development is suspicious.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "triage-compromise-signals",
      "type": "analytic",
      "label": "Triage compromise signals",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "identify-web-asset-inventory",
          "rare-dns-from-interpreters",
          "anomalous-ai-api-requests"
        ],
        "objective": "Identify hosts where rare DNS queries or AI API communications intersect with the presence of PHP/Node.js, citing rows that suggest a Go-based implant or key theft.",
        "description": "Synthesize the inventory and network signals to determine which hosts show signs of exploitation and AI-driven C2.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict linking the software presence to anomalous DNS or HTTP signals.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, with cited network anomalies."
      },
      "parents": [
        {
          "id": "rare-dns-from-interpreters",
          "kind": "merge"
        },
        {
          "id": "anomalous-ai-api-requests",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "encrypted-ai-payloads",
        "confidence": "high",
        "description": "Direct the hunt to containment or manual investigation based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-compromise-signals"
        }
      ]
    },
    {
      "id": "isolate-and-remediate",
      "type": "action",
      "label": "Isolate and remediate",
      "config": {
        "target": "endpoint",
        "description": "Halt active C2 and exfiltration by isolating the host.",
        "instructions": "Isolate the host immediately. Revoke any AI API keys associated with the host or found in its environment variables. Prepare for memory collection.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensic-evidence-collection",
      "type": "task",
      "label": "Forensic evidence collection",
      "config": {
        "assignee": "analyst",
        "description": "Gather artifacts to confirm the Go-based implant and proxy configuration.",
        "instructions": "Collect and analyze active network sockets for local proxy routing (127.0.0.1). Search for Go-based binaries in web server directories. Review PHP and Node.js logs for RCE patterns matching the Talos advisory."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-remediate"
        }
      ]
    },
    {
      "id": "patching-and-closure",
      "type": "task",
      "label": "Patching and closure",
      "config": {
        "assignee": "analyst",
        "description": "Ensure the estate is protected against the initial vulnerabilities and close the hunt.",
        "instructions": "Verify all hosts running PHP and Node.js are patched against the RCE vulnerabilities. Confirm the removal of any detected implants and finalize the incident report."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "forensic-evidence-collection"
        }
      ]
    }
  ]
}