CikaBika Bot RAT uses Discord for Command-and-Control

New RAT Discovered

Darktrace identified a new malware campaign deploying a Rust-based Remote Access Trojan (RAT) named CikaBika Bot. This RAT uniquely leverages Discord for its command-and-control (C&C) infrastructure, allowing attackers to manage infected systems remotely.

Distribution and Infection Vector

The CikaBika Bot is distributed through document-themed lures, likely as part of phishing attacks. Victims receive a PDF containing a disk image with a Windows shortcut (LNK) disguised as a Word document. Opening this LNK file displays a decoy document and initiates a hidden PowerShell process to decode and execute an embedded executable.

This executable is a Nim-based loader that drops a Rust DLL and a PowerShell deployment script. The script attempts to move the DLL into the protected Edge directory to bypass Windows User Account Control (UAC), potentially using DLL search-order hijacking by exporting functions associated with Microsoft's debugging library.

Malware Capabilities

Upon execution, the CikaBika Bot RAT registers the infected machine with Discord and begins its reconnaissance phase, collecting system information, processes, network configuration, and taking a screenshot. Attackers use Discord as an interactive interface to issue commands.

Operators can perform command execution, further reconnaissance, process enumeration and termination, file upload and download, and surveillance activities such as screenshots, camera access, streaming, and broadcasting. The RAT can also compress directories into ZIP archives and exfiltrate them via Ngrok, and request specific documents from the victim's system.

Implications of Discord Use

The use of Discord channels for individual victims and Ngrok for data exfiltration highlights how legitimate services are repurposed for malicious operations. This tactic allows attackers to blend C&C traffic with normal network activity, making detection more challenging.