Rust-Based CikaBika Bot Turns Discord into a Command Center

CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files.

Darktrace researchers have documented a new campaign distributing a remote access trojan called CikaBika Bot, written in Rust and controlled entirely through Discord. The infection chain starts with a disk image that looks like a business proposal, and ends with an attacker who can run arbitrary commands, steal files, and capture your screen, all through messages in a chat platform.

“The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s installation directory using a PowerShell UAC bypass.” reads the analysis published by Darktrace. “Once running, the RAT collects host information, registers the device with Discord, and accepts commands through a dedicated channel.”

The attackers use a disk image named Proposition_Projet.img as a lure; it contains two files, a PDF that appears to be a legitimate French-language document about writing summaries, and a Windows shortcut disguised as a Word document.

Open the shortcut and a hidden PowerShell process starts running in the background while the PDF displays on screen to keep the victim occupied.

The shortcut starts PowerShell, which reads the fake PDF as raw data. It uses a value hidden inside the file as a key to decrypt and extract a program, then saves it to a temporary folder. This program is a loader written in Nim, a programming language that is less common in malware than C. Attackers may use Nim because security tools are less familiar with it. The loader contains two more components: a Rust DLL and a PowerShell script.

The PowerShell script then tries to copy the DLL into Microsoft Edge’s installation folder and name it dbghelp.dll. This is the name of a legitimate debugging library that Edge normally loads. To access the protected folder without triggering a User Account Control (UAC) prompt, the script changes a Windows registry setting and misuses computerdefaults.exe to bypass the security check. Darktrace describes the technique as DLL search-order hijacking.

“The attacker appears to be exploiting this dependency through DLL search-order hijacking. However, it does not export every function in Edge’s delay-import table, meaning its compatibility with the host is incomplete.” the analysis continues.”The observed code establishes the intended sideloading route, rather than proving that Edge successfully loaded the planted DLL.”

However, the researchers note that the malicious DLL does not provide all the functions Edge expects, so this technique may not work on every system.

Assuming the implant lands and runs, it immediately registers the infected machine with Discord, creating a dedicated channel for that specific device. It then collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through that channel. The attacker gets a full picture of the machine within the first few seconds of infection.

The command set from there covers most of what an attacker would need. Remote shell access, process listing and termination, file upload and download, and surveillance functions including screenshot capture, camera access, and screen streaming.

“Once installed, CikaBika Bot uses Discord as its C2 platform, allowing the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure.” the cybersecurity firm states. “The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.”

Discord is a legitimate service used by millions of people and organizations every day. Traffic to Discord doesn’t look unusual on most networks, it’s not blocked by default, and standard endpoint security tools aren’t designed to treat Discord messages as potential command-and-control traffic. The attacker never has to spin up a dedicated server, register a suspicious domain, or deal with infrastructure that can get taken down. They just need a Discord account.

One drawback for attackers is that Discord can detect abuse and shut down the accounts and servers they use. However, creating new accounts is easy and costs very little. The attackers also use Ngrok to transfer files instead of sending large amounts of data through Discord. This reduces their reliance on Discord and limits the impact if the platform shuts down their accounts.

“CikaBika Bot demonstrates how attackers continue to rely on social engineering techniques to deliver malware.” concludes the report. “Although the initial distribution method has not been confirmed, the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF, suggests the campaign was designed for phishing.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

---

---