securityweek.comarticleCikaBika Bot RAT Uses Discord for C&C
SecurityWeek reports Darktrace's findings on CikaBika Bot, a Rust-based RAT delivered via a PDF containing a disk image with an LNK disguised as a Word document. A hidden PowerShell step drops a Nim loader and a Rust DLL that is moved into the protected Edge directory to bypass UAC and sideloaded via DLL search-order hijacking of debugging-library exports. The RAT uses per-victim Discord channels for C&C (recon, command execution, file transfer, screenshots/camera) and exfiltrates ZIPped data via Ngrok.
TL;DR Darktrace: Rust RAT CikaBika Bot arrives via PDF/LNK lure, sideloads a DLL, and uses Discord for C2 and Ngrok for exfiltration.
Organisations named here
- LNK
- UAC bypass
Technologies named here
- Darktrace
- Windows
- Microsoft Edge directory
- Discord
- Microsoft debugging library
- ngrok
- Nim-based loader
- PowerShell
- Rust
- Microsoft Edge
- Nim
Techniques named here
- Phishing with document-themed lures
- C&C over legitimate service
- Reconnaissance
- Surveillance
- DLL
Threat actors named here
- CikaBika Bot
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup