{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "NIK C2 collapses the delay between data collection and exploitation by using integrated AI models. Detecting its persistent footprint is critical to stopping the session before it transitions to screen-lock ransomware impact." }, "name": "NIK C2: Host Persistence and Evasion", "type": "investigation", "labels": [ "hunt", "attack.t1547.001", "attack.t1036.005", "attack.t1021.001", "attack.t1572", "attack.t1055.012", "attack.t1486", "command and control", "credential access", "defense evasion", "execution", "impact", "lateral movement" ], "series": { "slug": "nik-c2-the-new-ai-enabled-command-and-control-framework", "index": 1, "title": "NIK C2: The new AI-enabled command-and-control framework", "total": 2 }, "related": [ { "hunt": "nik-c2-credential-and-ai-surveillance", "reason": "This hunt focuses on persistence and evasion; surveillance and AI-driven theft commands are handled in a separate network-centric hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "While a rule can alert on svchost.exe in a user path, this hunt connects initialization (watchdog arguments), fleet rarity (baseline), and persistence (Registry Run keys) into a single narrative to distinguish the full NIK C2 lifecycle from isolated dropper events.", "coverage": [ { "stage": "execution-and-initial-setup", "steps": [ "scope-hosts-with-profile-binaries", "watchdog-monitoring" ], "status": "covered" }, { "stage": "persistence-and-defense-evasion", "steps": [ "rare-profile-binaries", "persistence-lifecycle" ], "status": "covered" }, { "stage": "lateral-movement-and-pivoting", "reason": "The hb_network_listener surface lacks device_hostname, making it impossible to scope proxy listeners to the hosts identified in this hunt.", "status": "not_visible", "blind_spot": "no-network-listener-scoping" }, { "stage": "ransomware-impact", "reason": "Ransomware impact is the final stage; this hunt aims for early detection and isolation before encryption occurs.", "status": "not_visible" }, { "stage": "credential-access-and-surveillance", "reason": "Belongs to another part of the 'NIK C2: The new AI-enabled command-and-control framework' series.", "status": "out_of_scope" }, { "stage": "c2-and-ai-integration", "reason": "Belongs to another part of the 'NIK C2: The new AI-enabled command-and-control framework' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Implant Execution and Initialization", "slug": "execution-and-initial-setup", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Go-based 64-bit Windows binary", "watchdog", "copywatchdog", "[NIK] Starting", "PID file in temporary application folder", "Named mutex for single-instance execution" ] }, { "name": "Persistence and Defense Evasion", "slug": "persistence-and-defense-evasion", "tactic": "defense-evasion", "techniques": [ "T1547.001", "T1055.012", "T1036.005", "T1070.006" ], "observables": [ "%appdata%/Roaming/Microsoft/Network", "svchost.exe", "simvol.exe", "Nov 29, 1979 (Zeroed PE TimeDateStamp)", "Registry Run keys", "Process hollowing", "Watchdog process monitoring" ] }, { "name": "Credential Access and Surveillance", "slug": "credential-access-and-surveillance", "tactic": "credential-access", "techniques": [ "T1003", "T1056.001", "T1555", "T1115", "T1125" ], "observables": [ "netsh wlan show profile", "Browser SQLite database access (cookies, passwords, autofill)", "Keylogger buffer dumps", "Clipboard interception", "Camera and microphone streaming", "Discord tokens", "Crypto wallet databases" ] }, { "name": "Lateral Movement and Pivoting", "slug": "lateral-movement-and-pivoting", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1572" ], "observables": [ "RDP session interaction", "SOCKS5/HTTP Proxy listener", "Reverse proxy tunnel for LAN pivoting" ] }, { "name": "C2 Communications and AI Integration", "slug": "c2-and-ai-integration", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1572" ], "observables": [ "total-sitevv.lol", "87.120.196.120", "api.openai.com/v1/chat/completions", "Port 443 WebSockets", "250ms HTTP polling interval", "OPENAI_API_KEY environment variable access", "gpt-4", "ai_generate command" ] }, { "name": "Screen-Lock Ransomware Impact", "slug": "ransomware-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Screen-locking module", "Ransom demand for Bitcoin or USDT" ] } ], "summary": "NIK C2 is a Go-based Windows implant that uses a dual-channel C2 architecture over WebSockets and HTTP fallbacks to maintain persistent control. The framework notably integrates the OpenAI API directly through the victim host to analyze stolen data and orchestrate commands, while also supporting credential theft, hidden VNC, and screen-locking ransomware." }, "severity": "high", "rationale": "Begin by examining hosts where binaries run from AppData/Roaming or Users/Public. NIK C2 relies on sub-paths like Microsoft\\Network and masqueraded names like svchost.exe. Use the persistence_path parameter to match sub-folders found in your telemetry.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has established persistence for the NIK C2 implant by placing masqueraded binaries in user profile paths and creating Registry Run keys to maintain an AI-augmented remote access session.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Target specific hosts identified in the scoping step; leave empty to hunt across the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "persistence_path": { "from": { "ref": "talos-nik-c2", "kind": "article", "observed": "2026-10-29" }, "type": "string", "default": "\\AppData\\Roaming\\Microsoft\\Network", "description": "The specific subdirectory used by NIK C2 for persistence; literal path found in telemetry." }, "implant_masquerade_names": { "from": { "ref": "talos-nik-c2", "kind": "article", "observed": "2026-10-29" }, "type": "list[string]", "default": [ "svchost.exe", "simvol.exe" ], "description": "Binary names the implant uses to masquerade as system processes." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/", "name": "Cisco Talos \u2014 NIK C2: The new AI-enabled command-and-control framework" } ], "blind_spots": [ { "id": "no-process-ancestry", "risk": "Identifying the implant but missing the initial delivery vector if it was exploit-driven.", "stage": "execution-and-initial-setup", "question": "whether the implant was launched by a specific web shell or phishing document", "requires": "hb_process_activity with parent command line history" }, { "id": "no-network-listener-scoping", "risk": "The hb_network_listener surface lacks a hostname column, preventing precise multi-host correlation for the lateral movement module.", "stage": "lateral-movement-and-pivoting", "question": "whether the implant's proxy listener is active on specific scoped hosts", "requires": "hb_network_listener with device_hostname" } ] }, "name": "NIK C2: Host Persistence and Evasion", "description": "This hunt targets the endpoint footprint of the NIK C2 implant, specifically its use of system process masquerading (svchost.exe, simvol.exe) and its watchdog supervisor routine. The hunt follows a phased flow: first, it identifies hosts with rare binaries in user-writable paths and checks for the implant's specific command-line arguments. Second, it corroborates these findings with Registry-based persistence mechanisms. Finally, an agent synthesizes the evidence to confirm the full malware lifecycle before an analyst takes action to prevent ransomware impact." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "nik-c2-the-new-ai-enabled-command-and-control-framework", "index": 1, "title": "NIK C2: The new AI-enabled command-and-control framework", "total": 2 }, "coverage": [ { "stage": "execution-and-initial-setup", "steps": [ "scope-hosts-with-profile-binaries", "watchdog-monitoring" ], "status": "covered" }, { "stage": "persistence-and-defense-evasion", "steps": [ "rare-profile-binaries", "persistence-lifecycle" ], "status": "covered" }, { "stage": "lateral-movement-and-pivoting", "reason": "The hb_network_listener surface lacks device_hostname, making it impossible to scope proxy listeners to the hosts identified in this hunt.", "status": "not_visible", "blind_spot": "no-network-listener-scoping" }, { "stage": "ransomware-impact", "reason": "Ransomware impact is the final stage; this hunt aims for early detection and isolation before encryption occurs.", "status": "not_visible" }, { "stage": "credential-access-and-surveillance", "reason": "Belongs to another part of the 'NIK C2: The new AI-enabled command-and-control framework' series.", "status": "out_of_scope" }, { "stage": "c2-and-ai-integration", "reason": "Belongs to another part of the 'NIK C2: The new AI-enabled command-and-control framework' series.", "status": "out_of_scope" } ], "rationale": "An intruder has established persistence for the NIK C2 implant by placing masqueraded binaries in user profile paths and creating Registry Run keys to maintain an AI-augmented remote access session.", "blind_spots": [ { "id": "no-process-ancestry", "risk": "Identifying the implant but missing the initial delivery vector if it was exploit-driven.", "stage": "execution-and-initial-setup", "question": "whether the implant was launched by a specific web shell or phishing document", "requires": "hb_process_activity with parent command line history" }, { "id": "no-network-listener-scoping", "risk": "The hb_network_listener surface lacks a hostname column, preventing precise multi-host correlation for the lateral movement module.", "stage": "lateral-movement-and-pivoting", "question": "whether the implant's proxy listener is active on specific scoped hosts", "requires": "hb_network_listener with device_hostname" } ], "scoping_notes": "Begin by examining hosts where binaries run from AppData/Roaming or Users/Public. NIK C2 relies on sub-paths like Microsoft\\Network and masqueraded names like svchost.exe. Use the persistence_path parameter to match sub-folders found in your telemetry.", "beyond_detection": "While a rule can alert on svchost.exe in a user path, this hunt connects initialization (watchdog arguments), fleet rarity (baseline), and persistence (Registry Run keys) into a single narrative to distinguish the full NIK C2 lifecycle from isolated dropper events." } }, { "id": "scope-hosts-with-profile-binaries", "type": "query", "label": "Identify hosts with profile-path execution", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, COUNT(*) AS execution_count FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\appdata\\roaming\\%') AND LOWER(process_path) LIKE '%' || LOWER('{{persistence_path}}') || '%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_path, process_cmd_line", "surface": "hb_process_activity", "description": "Find hosts where processes are running from user profile paths matching the specific folder named in research.", "expected_signal": "Rows identify hosts and paths where binaries execute from the targeted Network directory. Silence proves these specific paths are clear." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify hosts with profile-path execution", "reads": [ "device_hostname", "process_cmd_line", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, COUNT(*) AS execution_count FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\appdata\\roaming\\%') AND LOWER(process_path) LIKE '%' || LOWER('{{persistence_path}}') || '%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_path, process_cmd_line", "silence": "evidence_of_absence", "expected": "Rows identify hosts and paths where binaries execute from the targeted Network directory. Silence proves these specific paths are clear.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "watchdog-monitoring", "type": "query", "label": "Detect watchdog supervisor arguments", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%watchdog%' OR LOWER(process_cmd_line) LIKE '%copywatchdog%') AND (instr(',' || '{{implant_masquerade_names}}' || ',', ',' || LOWER(replace(process_path, rtrim(process_path, replace(process_path, '\\', '')), '')) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the specific Go-based watchdog tokens used by NIK C2 to monitor its masqueraded process.", "expected_signal": "A masqueraded process running with supervisor arguments. This is a high-fidelity indicator of NIK C2." }, "parents": [ { "id": "scope-hosts-with-profile-binaries" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detect watchdog supervisor arguments", "reads": [ "device_hostname", "process_cmd_line", "process_path", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%watchdog%' OR LOWER(process_cmd_line) LIKE '%copywatchdog%') AND (instr(',' || '{{implant_masquerade_names}}' || ',', ',' || LOWER(replace(process_path, rtrim(process_path, replace(process_path, '\\', '')), '')) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A masqueraded process running with supervisor arguments. This is a high-fidelity indicator of NIK C2.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "rare-profile-binaries", "type": "query", "label": "Which profile binaries are rare", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\roaming\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts < 3 ORDER BY hosts, runs", "surface": "hb_process_activity", "description": "Stack-count profile binaries across the fleet so the implant stands out from normal updaters.", "expected_signal": "Binaries seen on only one or two hosts in the entire estate. Genuine system binaries should never appear here." }, "parents": [ { "id": "scope-hosts-with-profile-binaries" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Which profile binaries are rare", "reads": [ "device_hostname", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\roaming\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts < 3 ORDER BY hosts, runs", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Binaries seen on only one or two hosts in the entire estate. Genuine system binaries should never appear here.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-10-30" } }, { "id": "triage-beachhead", "type": "analytic", "label": "Weigh beachhead evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scope-hosts-with-profile-binaries", "watchdog-monitoring", "rare-profile-binaries" ], "objective": "Identify hosts that show strong evidence of NIK C2 implant initialization and masquerading.", "description": "Determine if execution in user profiles combined with watchdog arguments and rarity indicates a NIK C2 implant.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious | suspicious for hosts matching the initialization pattern.", "success_criteria": "A list of hosts and their respective verdicts based on the provided telemetry." }, "parents": [ { "id": "watchdog-monitoring", "kind": "merge" }, { "id": "rare-profile-binaries", "kind": "merge" } ] }, { "id": "persistence-lifecycle", "type": "query", "label": "Detect Registry Run key persistence", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\currentversion\\run%' AND (LOWER(reg_value_data) LIKE '%\\appdata\\roaming\\%' OR instr(',' || '{{implant_masquerade_names}}' || ',', ',' || LOWER(replace(reg_value_data, rtrim(reg_value_data, replace(reg_value_data, '\\', '')), '')) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Find the registry entries the implant creates to survive reboots, corroborating the earlier beachhead findings.", "expected_signal": "Registry writes to Run keys pointing at binaries in user profiles or masqueraded system names. This confirms the persistence phase." }, "parents": [ { "id": "triage-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Detect Registry Run key persistence", "reads": [ "device_hostname", "process_name", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\currentversion\\run%' AND (LOWER(reg_value_data) LIKE '%\\appdata\\roaming\\%' OR instr(',' || '{{implant_masquerade_names}}' || ',', ',' || LOWER(replace(reg_value_data, rtrim(reg_value_data, replace(reg_value_data, '\\', '')), '')) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Registry writes to Run keys pointing at binaries in user profiles or masqueraded system names. This confirms the persistence phase.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "triage-lifecycle", "type": "analytic", "label": "Consolidate NIK C2 lifecycle", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "triage-beachhead", "persistence-lifecycle" ], "objective": "Determine if the evidence across multiple stages (initialization and persistence) confirms an active NIK C2 infection.", "description": "Synthesize the early beachhead signals with follow-on persistence findings to confirm a persistent C2 session.", "max_iterations": 6, "expected_signal": "A final verdict per host with a supporting narrative of the observed malware lifecycle.", "success_criteria": "A per-host verdict (malicious | suspicious | benign) citing rows from both early and follow-on stages." }, "parents": [ { "id": "persistence-lifecycle" } ] }, { "id": "route-infection", "type": "checkpoint", "label": "Route based on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-lifecycle verdict is malicious for at least one host", "condition": "the triage-lifecycle verdict is malicious for at least one host", "blind_spot": "no-process-ancestry", "confidence": "high", "description": "Isolate hosts with a confirmed NIK C2 infection to prevent lateral movement or ransomware deployment.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-lifecycle" } ] }, { "id": "isolate-endpoint", "type": "action", "label": "Isolate the compromised endpoint", "config": { "target": "endpoint", "description": "Halt the C2 session and prevent the deployment of the screen-locking module.", "instructions": "Isolate the endpoint. Collect the binary from the AppData/Roaming/Microsoft/Network path and the PID file from the temp directory for digital forensics.", "action_approval": "required" }, "parents": [ { "id": "route-infection", "branch": "on_supports" } ] }, { "id": "analyst-confirmation", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Conduct a manual review of the AI-integrated session prompts and any staged data for analysis.", "instructions": "Review the isolated host's network connections to api.openai.com. Analyze the content of the PID file found in the temp directory. Check for browser credential dumping or Discord token access as reported in the NIK C2 framework." }, "parents": [ { "id": "route-infection", "branch": "default" }, { "id": "route-infection", "branch": "on_unavailable" }, { "id": "isolate-endpoint" } ] }, { "id": "hunt-closure", "type": "task", "label": "Hunt closure and documentation", "config": { "assignee": "analyst", "description": "Record findings and close the hunt if no malicious activity was confirmed.", "instructions": "Summarize the hosts examined and confirm the absence of NIK C2 persistence artifacts in the scoped profiles. Document any false positives related to legitimate updaters in user paths." }, "parents": [ { "id": "route-infection", "branch": "on_refutes" } ] } ] }