Cisco Talos documented the emergence of NIK C2, an AI-enabled malware framework featuring a Windows implant with remote access trojan (RAT), information-stealing, surveillance, and screen-locking ransomware capabilities. According to Talos, the framework has been in development since December of 2024 and uses a Go-based infrastructure that abuses OpenAI’s API to perform AI interference. It offers more than 52 commands for browser credentials extraction, cryptocurrency theft, keylogging, hidden desktop control, network pivoting, and evasion through AMSI patching, UAC bypass, and process masquerading.
Perhaps the most striking feature of this framework is its integration of an OpenAI API Client directly into the Windows implant, allowing attackers to submit prompts using an ai_generate command through the victim’s machine using the victim’s API key and receive AI-generated responses that get forwarded to the C2 server.
YARA Authoring Process
Choosing the right candidates
The selection of the sample candidates was facilitated by their Hilbert Curve visualizations, which represents the file’s content through color and patterns. The resulting images exhibited a high degree of visual similarity, making these samples a good starting point for further analysis:
An important call-out is that while Hilbert Curves can help identify visual similarity among files, visual resemblance does not necessarily indicate that the files are exact variants of one another. For example, the images above reveal the following characteristics:
- Pink-reddish tones: Represent higher byte values, which typically corresponds to encrypted or compressed data.
- Blue tones: Represent ascii printable characters.
- Black tones: Represent null bytes, which typically indicate empty, padding or otherwise uninitialized data.
- Green tones: Represent low range byte values, which often includes control characters or non-printable bytes such as protocols.
Based on these observations, we can draw two preliminary conclusions:
- Since bytes located near each other in a file remain together in a Hilbert Curve visualization, the similar patterns suggest the files share a similar structure.
- Regions potentially containing encrypted or compressed data appear in similar locations across all four samples.
This is precisely where YARA becomes valuable: turning a needle-in-a-haystack scenario into an opportunity for high-precision detection. Although authoring effective YARA rules can be a tedious task, the resulting detections can significantly strengthen an organization’s detection coverage.
Analyzing sample candidates
The goal of this stage was to identify as many distinctive characteristics shared across the samples as possible, providing a foundation for crafting a high-fidelity YARA rule.
The samples were relatively large executable files (> 6MB) written in Go, which initially presented some challenges. Strings analysis revealed numerous references to legitimate development libraries and dependencies such as Walk, a Windows GUI toolkit for Go, and screenshot, a Go library used for screen capture. While these references provided useful context about the binaries’ behavior, they were not sufficiently distinctive to serve as reliable detection indicators on their own.
As the analysis progressed, however, several NIK C2-specific characteristics began to emerge. We collected these distinctive indicators, compared their presence across the samples, and used them as the starting point for developing the YARA rule.
The four initial samples selected for analyses were:
6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5
ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c
30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba
1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073aTesting and tuning
Testing approaches vary depending on the sample set and the intended purpose of a YARA rule. For example, if the goal is broad file identification, such as identifying .NET executable files, a high match rate is expected. Conversely, rules designed for threat hunting purposes may intentionally favor broader coverage at the expense of precision, potentially generating more false positives. When the goal is high-fidelity, detection-grade rule, however, careful selection of both strings and the condition is required to minimize false positives while maintaining reliable detection coverage.
The objective was to develop a high-fidelity YARA rule capable of reliably identifying NIK C2 samples. After composing the initial draft, the next step was to evaluate its effectiveness and determine whether the selected strings indicators could consistently detect the malware. At this stage, the primary focus was ensuring that the rule matched against all four original samples. Several testing iterations revealed the need for adjustments, including experimenting with different string modifiers such as ascii and nocase, until all four samples were successfully detected.
The rule’s condition was built around three criteria. First, we included a check for the Windows PE executable’s MZ header (uint16(0) == 0x5A4D). Second, we introduced a filesize constraint based on the observation that all four samples exceeded 6MB. Lastly, we established a balanced string-matching condition, neither too broad nor too narrow, to account for variations among the samples without compromising detection precision.
An important consideration before proceeding to corpus-wide scan is minimizing unnecessary iterations and potential false positives. This requires thoroughly reviewing and refining the rule’s detection logic, ensuring that each selected indicator contributes meaningfully to its overall reliability. A high-fidelity rule should accommodate variations within the same malware family while avoiding matches against unrelated software.
With the rule refined and its detection logic validated, the next step was to put it out to the test against Stairwell’s multi-petabyte malware corpus.
The YARA Rule
rule NIK_C2_RAT_Ransomware {
meta:
author = "Evelyne Diaz Araque ([email protected])"
date = "2026-11-04"
description = "Detects NIK C2: an AI-integrated RAT and Ransomware framework."
ref = "https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/"
hash0 = "6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5"
hash1 = "ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c"
hash2 = "30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba"
hash3 = "1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a"
strings:
$s0 = "//opt//nik_panel//data//build_913260c1a4bee6e0//main.go" ascii nocase
$s1 = "NIK_BOOTH" ascii nocase
$s2 = "NIKFilteragent" ascii nocase
$s3 = "LookupServiceBeginW[NIK] Connecting to %s" ascii nocase
$s4 = "GetCurrentPebGetGUIThreadInfoWinVerifyTrustEx[NIK]" ascii nocase
$s5 = "SelectedDriverW[NIK]" ascii nocase
$s6 = "consoleGetProcAddressnik_backup" ascii nocase
$s7 = "LOCALAPPDATANIK_UPSTREAM"
condition:
uint16(0) == 0x5A4D and filesize > 6MB and 4 of ($s*)
}Scan results
The original Cisco Talos report listed 8 sample hashes. Using our newly developed YARA rule, we were able to identify 10 additional NIK C2 variants, bringing the total to 18 known samples.
Examining their Hilbert Curve visualizations we see a notable degree of variation among the matched files. Despite these differences, further analysis confirmed that all 10 newly identified samples contained characteristics associated with NIK C2. These findings demonstrate the effectiveness of our high-fidelity YARA rule in identifying additional variants of the malware family, including samples that differ visually from those initially used during the rule development.
Hilbert Curves of all 18 samples:
IOCs
The following SHA-256 hashes correspond to the 10 additional NIK C2 samples identified during our research:
9b228bf578fee16d5ccd880ecafcc7159d3678ef09d7fa5c807d423f97d48a9e
5a39bd95d430a1093b3d179d100389ee2cf60226518b82e02572f3e25df2f803
0008c95fb43bd97dec04c408b61a66a38f59a7912e4d4a058647ef14407463f2
507436d5132cefeea7e35e3481c5726f00a90e041a6bbb55cfcf50b51e2b3b73
626619e1a2ba0cfaf7809ad3fed0d8958762379bcdc549125699ce7e6a938500
876b1dbc4bcfc548d1fbf8ac8d4fe7dfa15df80e5085372397dffb814c5e5352
d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24
e7f51534b1106707a7e86b1531dfd4444639b824baec66c5e1ad8005b1f7da0a
a7279f2425746deafef5c2ff6ebe612c7cc6062601be37d83e07ecdd1bb72ba2
0fb93dbb9525004f9e5b1ee4bcd6b6638700bee576413e955c8c96292fa964eeIn an era of increasingly AI-enabled cyber threats, where threat actors no longer need to possess sophisticated capabilities, strengthening defensive capabilities through scalable detection strategies is essential. Combining high-fidelity YARA rules with a multi-petabyte malware corpus provides a powerful approach to identifying previously unknown malware variants and expanding threat detection coverage.