Darktrace Details Rust-Based CikaBika Bot Campaign Using Discord for C2
A new remote access trojan uses fake business proposals to infect Windows systems, leveraging Discord and Ngrok for command execution and data theft.
Key points
- CikaBika Bot is a Rust-based remote access trojan controlled via Discord channels.
- The infection chain begins with a disk image containing a malicious Windows shortcut.
- Attackers use DLL search-order hijacking to install the payload in Microsoft Edge.
Darktrace researchers have documented a new malware campaign distributing CikaBika Bot, a remote access trojan written in Rust. According to the security firm, the malware relies entirely on Discord for command and control, allowing attackers to execute arbitrary commands, spy on victims, and steal files through chat messages.
The infection chain starts with a disk image named Proposition_Projet.img, which appears to be a business proposal. This file contains a legitimate-looking French-language PDF about writing summaries and a Windows shortcut disguised as a Word document. When a user opens the shortcut, a hidden PowerShell process runs in the background while the PDF displays to distract the victim.
Technical Analysis of the Infection Chain
The PowerShell script reads the fake PDF as raw data and uses a hidden value within the file as a decryption key. It then extracts and saves a Nim-based loader to a temporary folder. Darktrace notes that attackers may choose Nim because security tools are less familiar with this programming language compared to C. The loader contains two additional components: a Rust dynamic-link library and another PowerShell script.
The subsequent PowerShell script attempts to copy the Rust DLL into the Microsoft Edge installation directory, naming it dbghelp.dll. This name matches a legitimate debugging library that Edge normally loads. To access this protected folder without triggering a User Account Control prompt, the script modifies a Windows registry setting and misuses computerdefaults.exe to bypass the security check.
Darktrace describes this technique as DLL search-order hijacking. Once the DLL is successfully installed and loaded by Edge, the remote access trojan activates. It collects host information, registers the infected device with Discord, and begins accepting commands through a dedicated channel. The malware also utilizes Ngrok to facilitate command execution and data exfiltration from the compromised systems.
Who Is Affected
Windows systems are the primary target of this campaign, specifically those where users open executable shortcuts from downloaded disk images. The lure is a business proposal document, suggesting that attackers may be targeting professionals or organizations that handle such files. The use of a French-language document indicates a potential regional focus or specific targeting of French-speaking users, though the malware itself is not language-dependent.
Any user who opens the disguised Word document shortcut within the Proposition_Projet.img file risks infection. The malware does not require user interaction beyond opening the shortcut, as the PowerShell process runs silently in the background. Once installed, the attacker gains the ability to run arbitrary commands, capture the screen, and steal files from the infected machine.
What should you do?
Security teams should monitor for unusual Discord activity or connections to unknown channels from endpoints. Endpoint detection and response tools should be configured to alert on PowerShell processes spawned by Windows shortcuts or disk images. Administrators should also watch for attempts to modify registry settings related to User Account Control or the use of computerdefaults.exe for privilege escalation.
Background: Endpoint detection and response (EDR)
Endpoint detection and response examples include blocking PowerShell scripts that download payloads, isolating devices showing abnormal memory access, and rolling back file changes. These tools monitor behavior, not just signatures, to stop advanced threats that evade standard security controls.
Read the full guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
What to do and how to stay safe: CikaBika Bot
- Monitor network traffic for unexpected connections to Discord servers or Ngrok tunnels from internal workstations.
- Configure endpoint detection rules to flag PowerShell processes launched by .lnk files or from mounted disk images.
- Review file integrity monitoring logs for unauthorized changes to the Microsoft Edge installation directory, specifically new DLL files.
- Educate users to avoid opening executable shortcuts from downloaded archives, even if they appear to be common document formats.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What programming language is CikaBika Bot written in?
The remote access trojan is written in Rust, though it uses a Nim-based loader during the initial infection phase.
How does the malware bypass User Account Control?
It modifies a Windows registry setting and misuses computerdefaults.exe to bypass the security check when copying files to protected directories.
What is the initial lure used in this campaign?
Attackers use a disk image named Proposition_Projet.img containing a fake business proposal PDF and a malicious Windows shortcut.
