New CikaBika Bot RAT uses Discord channels to control infected Windows PCs

Security firm Darktrace has detailed a previously undocumented remote access trojan called CikaBika Bot that uses Discord as its command-and-control channel. In a report published on October 14, Darktrace said the Rust-based malware is delivered through document-themed lures, likely by phishing, and gives every infected Windows machine its own Discord channel. SecurityWeek, which covered the research, noted that the abuse of legitimate services makes the malicious traffic harder to separate from normal activity.

What happened

According to Darktrace, the campaign uses a disk image named Proposition_Projet.img that contains a French-language decoy PDF and a Windows shortcut disguised as a Word document (Proposition_Projet_Personnalisable.docx.lnk). Opening the shortcut displays the decoy while a hidden PowerShell process decodes an executable embedded in the PDF and runs it from the temporary folder. Darktrace said it could not confirm how the lure was delivered, but the file names suggest phishing. The report does not name specific victims, sectors or countries.

Technical details

The decoded payload is a Nim-based loader that carries a Rust DLL and a PowerShell deployment script, Darktrace said. The script attempts a User Account Control bypass by modifying the ms-settings registry key so that computerdefaults.exe copies the DLL into the protected Microsoft Edge directory as dbghelp.dll. Because Edge has a delay-loaded dependency on that library, the attackers appear to rely on DLL search-order hijacking. Darktrace cautioned that the planted DLL only partially matches the functions Edge expects and that the code shows the intended route rather than proof that Edge loaded it.

Once running, CikaBika Bot registers the machine with Discord, collects system details, process lists and network configuration, and attempts a screenshot. The operator then issues commands such as !shell, !sysinfo, !tasklist, !kill, !upload and !download in the victim's channel. Strings in the code also reference camera, screenshot and streaming functions, which Darktrace did not see in use. In the observed activity, the attacker compressed a directory into a ZIP archive and exfiltrated it through ngrok, and used !download to steal a specific document from the victim's desktop.

What to do

Darktrace published file hashes for the decoy PDF, the shortcut, the loader and the malicious DLL, and mapped the activity to MITRE ATT&CK techniques including LNK execution, PowerShell, UAC bypass, DLL hijacking and web service command channels. Defenders can watch for:

• hidden PowerShell processes launched from shortcut files inside mounted disk images;
• changes under the HKCU\Software\Classes\ms-settings registry key;
• new DLL files written to the Microsoft Edge application directory;
• Discord API traffic from non-browser processes and unexpected ngrok connections.

Blocking or restricting the automatic mounting of disk image attachments from email also reduces exposure to this kind of lure.