Darktrace identifies CikaBika Bot malware using Discord for commands

Darktrace researchers have identified a new malware campaign involving the CikaBika Bot, a remote access trojan (RAT) written in the Rust programming language. The malware utilizes legitimate services like Discord and Ngrok to function as a command-and-control center and to exfiltrate files, allowing attackers to avoid using suspicious custom infrastructure.

The infection process typically begins with a disk image disguised as a business proposal, such as ‘Proposition_Projet.img’. This image contains a legitimate-looking French-language PDF and a malicious Windows shortcut disguised as a Word document. When the shortcut is opened, a hidden PowerShell process executes, using the PDF file as a source of encrypted data to extract a loader written in the Nim programming language.

To maintain persistence and evade detection, the malware attempts to perform DLL search-order hijacking. It uses a PowerShell script to bypass User Account Control (UAC) and attempts to plant a malicious DLL named ‘dbghelp.dll’ into the Microsoft Edge installation directory, mimicking a legitimate debugging library. Once active, the bot can capture screens, steal files, and execute arbitrary commands via Discord channels.