Darktrace details CikaBika Rust RAT using Discord

Darktrace says the CikaBika Rust RAT infects Windows via disk-image lures, uses Discord for control, and Ngrok to exfiltrate files.

Darktrace documented a campaign distributing CikaBika Bot, a Rust remote-access trojan for Windows that uses Discord for command and control and Ngrok to move stolen files. The sources disagree on the lure: SecurityWeek describes a PDF containing a disk image and a Windows LNK disguised as a Word document, while Security Affairs says victims open a disk image named Proposition_Projet.img that holds a decoy French PDF and a disguised shortcut. Both say PowerShell and a Nim loader deploy a Rust DLL into Microsoft Edge’s directory so it can be sideloaded by DLL search-order hijacking of a debugging library. Security Affairs is more specific, identifying the planted file as dbghelp.dll and the UAC bypass as computerdefaults.exe. Once running, the implant gathers system information and screenshots and takes execution and file commands over Discord, with archives sent out through Ngrok; Security Affairs also reports per-host Discord channels, remote shell, camera access, and screen streaming, which the earlier report does not mention.

• Darktrace documented CikaBika Bot; SecurityWeek reported it on 2026-10-15 and Security Affairs on 2026-10-18.
• CikaBika is a Rust remote-access trojan for Windows, delivered with a Nim loader and PowerShell.
• Sources disagree on the lure: a PDF holding a disk image and a Word-disguised LNK, versus disk image Proposition_Projet.img containing a French PDF decoy and a disguised shortcut.
• A Rust DLL is placed in Microsoft Edge’s directory for DLL search-order hijacking of a Microsoft debugging library; Security Affairs names it dbghelp.dll and cites a computerdefaults.exe UAC bypass.
• Discord carries operator commands; Security Affairs says each victim gets its own channel.
• The RAT collects system data and screenshots; SecurityWeek also cites process and network data, execution and file commands, and ZIP exfiltration.
• Security Affairs adds remote shell, file theft, camera access, and screen streaming.
• Ngrok is used to transfer stolen files outside Discord.