A newly identified AI-enabled command-and-control (C2) framework, known as NIK C2, uses a Go-based Windows implant to provide attackers with persistent remote access, credential theft, keylogging, surveillance, and lateral movement capabilities. The framework integrates OpenAI's API to process stolen information and generate AI responses directly from compromised systems. It also supports screen-locking ransomware, process masquerading, and security evasion techniques. NIK C2 communicates through encrypted WebSocket and HTTP channels, with active infrastructure identified at 87[.]120[.]196[.]120 and total-sitevv[.]lol, highlighting the growing use of AI in advanced cybercriminal operations.
- AI Integration & OpenAI API Abuse: NIK C2 integrates artificial intelligence capabilities and can leverage the infected victim's own stolen or local OpenAI API keys to process AI requests and assist the attacker. [1, 2]
- Windows Implant: It features a Go-based Windows implant used by threat actors to perform malicious actions. [1, 2]
- Core Functions: The framework facilitates credential dumping, keystroke streaming/logging, data exfiltration, system control, and potential ransomware deployment. [1, 2, 3]
- Adversary Tradecraft: It blends collection and exploitation into continuous operations on compromised hosts. [1]
On the other hand, multiple attacks targeted camera management software as an initial entry point into corporate networks. Following the compromise of CMS.exe, attackers deployed rs.win32.exe for suspected reverse-shell access and abused the legitimate Windows executable WpcMon.exe to sideload malicious DLLs (samcli.dll and IPHLPAPI.DLL). The attackers established persistence through Windows Registry Run keys and used the modified DLLs to communicate with an attacker-controlled command-and-control server. These incidents highlight the security risks associated with poorly secured camera management platforms and the abuse of legitimate Windows components to conceal malicious activity.
Also, Researchers identified a credential-phishing campaign active since September 2026 that impersonates Anthropic's AI preview invitations to steal Google and Microsoft account credentials. Threat actors abuse the legitimate GoTo Webinar service and URL shorteners to distribute phishing links while using Cloudflare and custom CAPTCHAs to evade automated security analysis. Victims are redirected to a fake Zoom meeting registration page before encountering fraudulent Google or Microsoft login pages. The Google phishing page collects usernames, while the Microsoft page captures both usernames and passwords. The campaign uses deceptive domains and trusted service branding to bypass email security controls, potentially enabling attackers to compromise corporate accounts, access sensitive information, and conduct further attacks.
And, Researchers revealed that the GOLD OGRE threat group has extensively integrated artificial intelligence into its Aur0ra ransomware operations, using AI-assisted tools to develop attack capabilities, test EDR evasion techniques, and automate post-exploitation activities. The group leveraged Cursor and multiple AI models to conduct network reconnaissance, Active Directory enumeration, credential harvesting, privilege escalation, and lateral movement with limited human intervention. Attackers also employed techniques such as password spraying, Kerberoasting, NTLM relay, and process injection to gain privileged access and identify valuable systems, including backup servers and network shares. The operations involved Cobalt Strike for command-and-control activities and S3-compatible storage for staging and exfiltrating stolen data. Researchers identified shared infrastructure and evidence suggesting Russian-speaking operators, with several affected organizations subsequently appearing on Aur0ra's data leak site.
