{"type": "bundle", "spec_version": "2.0", "id": "bundle--66acbda8-779d-43cb-8a16-4b8e85220d69", "objects": [{"type": "identity", "id": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:56:52.000Z", "modified": "2026-10-20T04:56:52.000Z", "name": "Talos", "identity_class": "organization"}, {"type": "report", "id": "report--6b367009-883e-488a-8931-dc29fccccc7f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:56:52.000Z", "modified": "2026-10-20T04:56:52.000Z", "name": "NIK C2: The new AI-enabled command-and-control framework", "published": "2026-10-29T10:05:03Z", "object_refs": ["observed-data--e7232622-4f02-4d20-9fa8-01693608b3d0", "indicator--e54c6688-4103-4488-9a40-6f3a9739ed14", "indicator--414e2fef-a122-4127-85ac-37bbf3876fea", "indicator--30c751d3-5b3f-41a2-9f50-68a9f40029a3", "indicator--0c6cbb53-99a3-422a-b558-6f71edbc7297", "indicator--d68e9baf-0581-4dab-b96b-e1d4e134ddef", "indicator--6b9a0a17-2d24-4ff8-addc-7366755734ae", "indicator--4206af64-b9bc-4c44-aa63-e34c646902e4", "indicator--bf8f01ac-85c1-4452-9d2b-b8eefbe115c5", "indicator--a0b327df-5769-4aec-986a-e5868323f58b", "indicator--3fe4a9a0-5a5e-461b-8f02-e6326bd95727", "indicator--b56e811c-2470-47a4-a69b-ad76e1c76d50", "indicator--c1be6f03-a7bc-41c4-8109-4f6a32ff253b", "x-misp-attribute--1147a904-dcb3-48ce-876f-e26493ff3c14"], "labels": ["Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "c2 framework", "tlp:clear", "Cisco Talos"]}, {"type": "observed-data", "id": "observed-data--e7232622-4f02-4d20-9fa8-01693608b3d0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:05:59.000Z", "modified": "2026-10-20T04:05:59.000Z", "first_observed": "2026-10-20T04:05:59Z", "last_observed": "2026-10-20T04:05:59Z", "number_observed": 1, "objects": {"0": {"type": "url", "value": "https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework"}}, "labels": ["misp:type=\"url\"", "misp:category=\"External analysis\""]}, {"type": "indicator", "id": "indicator--e54c6688-4103-4488-9a40-6f3a9739ed14", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = 'ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--414e2fef-a122-4127-85ac-37bbf3876fea", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--30c751d3-5b3f-41a2-9f50-68a9f40029a3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0c6cbb53-99a3-422a-b558-6f71edbc7297", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--d68e9baf-0581-4dab-b96b-e1d4e134ddef", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = 'bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6b9a0a17-2d24-4ff8-addc-7366755734ae", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--4206af64-b9bc-4c44-aa63-e34c646902e4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--bf8f01ac-85c1-4452-9d2b-b8eefbe115c5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "NIKC2 implant", "pattern": "[file:hashes.SHA256 = '2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a0b327df-5769-4aec-986a-e5868323f58b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "C2 domain", "pattern": "[domain-name:value = 'total-sitevv.lol']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--3fe4a9a0-5a5e-461b-8f02-e6326bd95727", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "C2 domain", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '87.120.196.120']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b56e811c-2470-47a4-a69b-ad76e1c76d50", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "C2 domain", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '2.26.51.12']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--c1be6f03-a7bc-41c4-8109-4f6a32ff253b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:09:31.000Z", "modified": "2026-10-20T04:09:31.000Z", "description": "C2 URL", "pattern": "[url:value = 'https://2.26.51.12:4443/api/c2/update']", "valid_from": "2026-10-20T04:09:31Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "x-misp-attribute", "id": "x-misp-attribute--1147a904-dcb3-48ce-876f-e26493ff3c14", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-10-20T04:56:52.000Z", "modified": "2026-10-20T04:56:52.000Z", "labels": ["misp:type=\"text\"", "misp:category=\"Attribution\""], "x_misp_category": "Attribution", "x_misp_type": "text", "x_misp_value": "NIK C2 implant"}]}