CikaBika Bot RAT abuses Discord for command-and-control
Darktrace researchers have found a new campaign spreading a remote access trojan (RAT) written in Rust that receives its orders through Discord.
The malware, which Darktrace calls CikaBika Bot, lets attackers scout infected systems, run commands remotely and steal data. It reaches victims through lures disguised as documents, and Darktrace believes it is most likely spread through phishing attacks.
A PDF, a disk image and a fake Word file
The infection chain starts with a PDF file. Inside it is a disk image that holds a Windows shortcut (LNK) file made to look like a Word document.
When the victim opens the shortcut, it shows a decoy document so nothing looks out of place. In the background, it starts a hidden PowerShell process that decodes an embedded executable and runs it.
That executable is a loader written in Nim. It carries two components, a DLL written in Rust and a PowerShell script used for deployment. Both are written to temporary files.
The script then tries to move the DLL into the protected Edge directory. The goal is to get around User Account Control (UAC), the Windows feature that asks users to approve actions that need elevated privileges.
Darktrace says the attackers likely try to sideload their code through DLL search-order hijacking. To do this, the malicious DLL exports functions associated with Microsoft's debugging library. A legitimate program that searches for that library may end up loading the attackers' file instead.
Discord as a control panel
The final payload is the CikaBika Bot RAT itself. As soon as it runs, it registers the infected machine with Discord and starts its reconnaissance routine. It collects system information, a list of running processes and network configuration details, and it takes a screenshot.
Discord acts as an interactive interface between the operator and the compromised computer. Commands go out and reports come back through the platform. Darktrace observed the attackers using separate Discord channels for individual victims.
The commands available to the operator let them:
- execute commands on the infected system
- run reconnaissance
- list running processes and terminate them
- upload and download files
- take screenshots
- access the camera
- stream and broadcast from the infected machine
The surveillance features stand out. Together with screenshot capture, camera access and streaming give the operator a live view of the victim, not just access to files.
Stolen files leave through Ngrok
Data theft is built into the malware. According to Darktrace, the attackers can compress entire directories into ZIP archives and send them out through Ngrok, a legitimate tunnelling service that makes local systems reachable over the internet. They can also request specific documents from the victim's computer.
This means the stolen data does not have to travel to an obviously suspicious server. Commands arrive through a popular chat platform, and files leave through a widely used developer tool.
"The observed use of Discord channels for individual victims, alongside additional data exfiltration through Ngrok, shows how legitimate services can be repurposed to support malicious operations," Darktrace noted.
Why It Matters
CikaBika Bot fits a pattern that has become hard to ignore: attackers increasingly hide their infrastructure inside services that defenders cannot simply block. We recently covered the PoeLLM botnet hiding its C2 address in a GitHub poem, and the logic here is similar. Traffic to Discord or Ngrok can look routine on many networks, which makes filtering based on domain reputation alone far less useful.
For organizations, this suggests it is worth asking whether Discord and Ngrok have any business purpose on corporate endpoints at all. Where they do not, monitoring or restricting that traffic could remove a convenient channel for this kind of malware.
The delivery chain also deserves attention. A shortcut packed inside a disk image inside a PDF, followed by a Nim loader, a Rust DLL and PowerShell, adds layers that each have to be unpacked during analysis. That layering may help the malware slip past tools tuned for simpler attachments, although the source does not say how successful the campaign has been.
The surveillance features put CikaBika Bot alongside other RATs that sell or offer webcam spying as a core function. Darktrace has not said who is behind the campaign or which victims are being targeted. It is worth watching whether more details on targeting emerge, and whether the use of a separate Discord channel for each victim turns up in other malware families.