Researchers at Darktrace have identified CikaBika Bot, a Rust-based remote-access trojan that turns Discord channels into an interactive command-and-control platform. The malware was observed collecting host information, executing commands, retrieving files and supporting data theft through the legitimate collaboration service. [3]
The delivery method has not been confirmed, but the infection chain is consistent with a phishing campaign. A disk image named Proposition_Projet.img contained a French-language PDF and a Windows shortcut disguised as a Word document. Opening the shortcut displayed the PDF as a decoy while launching hidden PowerShell. The script decoded an embedded executable from the PDF and wrote it to a temporary location before execution.
A Nim-based loader then decoded a Rust DLL and another PowerShell script. The deployment script attempted to bypass User Account Control by changing HKCUSoftwareClassesms-settingsshellopencommand, launching computerdefaults.exe and moving the payload into Microsoft Edge’s installation directory as dbghelp.dll. That was intended to enable DLL search-order hijacking through Edge, although Darktrace said the DLL exported only a subset of the functions expected by the browser and did not establish that Edge successfully loaded it. [3]
Once active, CikaBika registered the device with Discord and created or used a dedicated channel for the victim. Its reconnaissance included hostname and system details, running processes, network configuration, public-IP discovery through ipify.com and screenshots. The command handlers included !shell, !tasklist, !ps, !kill, !upload and !download; the report also identified strings associated with camera access, streaming and broadcasting, without confirming that those functions operated successfully.
In observed activity, the operator used Discord-delivered PowerShell commands to compress a directory into a ZIP archive and exfiltrate it through ngrok. The attacker also requested a document from the victim’s desktop, which the RAT returned through the device’s Discord channel. This use of trusted services can complicate network-based detection, but defenders can monitor unusual Discord and ngrok activity from endpoints, inspect shortcut files and disk-image attachments, and alert on hidden PowerShell, encoded commands, suspicious ms-settings registry changes and unauthorized DLLs in the Edge directory.
Darktrace did not identify a CVE, named threat actor, specific victim organization or exploitation of a disclosed vulnerability in the campaign. The report describes malicious activity rather than a vulnerability exploit, and it does not identify a conventional persistence mechanism such as a scheduled task, service or startup entry. Organizations should treat document-themed LNK files and unexpected Discord-based command traffic as high-risk indicators and use the hashes and paths published in the research report for detection and hunting. [3]
