CikaBika Bot RAT Uses Discord for C&C
Darktrace reports CikaBika, a Rust RAT using Discord for C2, delivered by phishing PDFs and LNK loaders.
Darktrace reports a campaign distributing CikaBika Bot, a Rust remote-access trojan that uses Discord for command and control. Victims receive a PDF containing a disk image and a Windows LNK disguised as a Word document; opening it shows a decoy and runs hidden PowerShell. A Nim loader writes a Rust DLL and deployment script, attempts to place the DLL in the Edge directory to bypass UAC, and likely sideloads it through DLL search-order hijacking. The RAT collects system, process, and network data plus screenshots, accepts execution and file commands over Discord, and can zip directories for exfiltration through Ngrok.
- CikaBika is a Rust RAT spread through PDF lures that contain LNK shortcuts.
- A Nim loader drops a Rust DLL and PowerShell attempts a UAC bypass.
- Attackers use DLL search-order hijacking against a Microsoft debugging library.
- Discord carries operator commands while Ngrok exfiltrates ZIP archives and documents.
Full article326 words · extracted from securityweek.com · click to collapse
Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).
Dubbed CikaBika Bot, the malware has been distributed via document-themed lures, likely as part of phishing attacks, and provides attackers with reconnaissance, remote execution, and data exfiltration capabilities on infected systems.
Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.
The executable is a Nim-based loader containing a Rust DLL and a PowerShell deployment script that are written to temporary files. The script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).
According to Darktrace, the attackers likely attempt to sideload the malicious code through DLL search-order hijacking by exporting functions associated with Microsoft’s debugging library.
The final payload is the CikaBika Bot RAT, which immediately registers the infected machine with Discord and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking a screenshot.
Advertisement. Scroll to continue reading.
Commands and reports are transmitted via Discord, which is used as an interactive interface. The operator can issue command execution, reconnaissance, process enumeration/termination, file upload/download, and surveillance (screenshot, camera, streaming, and broadcasting) commands.
According to Darktrace, the attackers can use the RAT to compress directories into ZIP archives and exfiltrate them via Ngrok, and can request specific documents from the victim’s system.
“The observed use of Discord channels for individual victims, alongside additional data exfiltration through Ngrok, shows how legitimate services can be repurposed to support malicious operations,” Darktrace notes.
Related: XWorm RAT Evolves Into Surveillance Platform
Related: In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor