/
← Voltar ao feed
medium

CikaBika Bot: Rust RAT delivered via disk-image lure uses Discord for C2 and Ngrok for exfiltration

1 fonte(s) · 1 atualização(ões) · publicado 18/10/2026 08:33 · coletado há 1 dia

Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named Proposition_Projet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts the final payload and tries to plant it in the Microsoft Edge installation directory using a PowerShell UAC bypass. Once running, the RAT registers each victim with a dedicated Discord channel and accepts commands for remote shell access, file theft and surveillance. The initial distribution method has not been confirmed, but the lure design suggests phishing.

Technical Details

  • The shortcut launches a hidden PowerShell process while the decoy PDF is displayed. PowerShell reads the PDF as raw data, uses a key hidden inside it to decrypt and extract a Nim loader, and saves it to a temporary folder.
  • The loader contains a Rust DLL and a PowerShell script. The script tries to copy the DLL into Edge's installation folder as dbghelp.dll, a legitimate debugging library that Edge normally loads (DLL search-order hijacking).
  • To write to the protected folder without a UAC prompt, the script changes a registry setting and misuses computerdefaults.exe.
  • The malicious DLL does not export every function in Edge's delay-import table, so sideloading may not work on every host. Darktrace notes the code establishes the intended route but does not prove Edge loaded the DLL.
  • On execution, the implant registers the device with Discord (one channel per victim), runs tasklist and ipconfig, takes a screenshot and sends everything to the operator.
  • The command set includes remote shell, process listing and termination, file upload and download, screenshot capture, camera access and screen streaming.
  • Ngrok is used to move larger files, which reduces dependence on Discord if the accounts are shut down.
  • Discord traffic is not blocked by default and is rarely treated as C2, so the operators need no dedicated infrastructure.

Remediation

  • The article gives no explicit remediation steps.
  • Defenders should consider monitoring for Discord and Ngrok traffic that is unexpected for the environment.
  • Defenders should also watch for disk images and LNK files executing PowerShell, computerdefaults.exe registry abuse, and an unexpected dbghelp.dll in the Edge installation directory.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 18/10/2026 08:33 · coletado 19/10 17:54 primeiro registro

    CikaBika Bot: Rust RAT delivered via disk-image lure uses Discord for C2 and Ngrok for exfiltration

    ler a análise desta fonte

    Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named Proposition_Projet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts the final payload and tries to plant it in the Microsoft Edge installation directory using a PowerShell UAC bypass. Once running, the RAT registers each victim with a dedicated Discord channel and accepts commands for remote shell access, file theft and surveillance. The initial distribution method has not been confirmed, but the lure design suggests phishing.

    Technical Details

    • The shortcut launches a hidden PowerShell process while the decoy PDF is displayed. PowerShell reads the PDF as raw data, uses a key hidden inside it to decrypt and extract a Nim loader, and saves it to a temporary folder.
    • The loader contains a Rust DLL and a PowerShell script. The script tries to copy the DLL into Edge's installation folder as dbghelp.dll, a legitimate debugging library that Edge normally loads (DLL search-order hijacking).
    • To write to the protected folder without a UAC prompt, the script changes a registry setting and misuses computerdefaults.exe.
    • The malicious DLL does not export every function in Edge's delay-import table, so sideloading may not work on every host. Darktrace notes the code establishes the intended route but does not prove Edge loaded the DLL.
    • On execution, the implant registers the device with Discord (one channel per victim), runs tasklist and ipconfig, takes a screenshot and sends everything to the operator.
    • The command set includes remote shell, process listing and termination, file upload and download, screenshot capture, camera access and screen streaming.
    • Ngrok is used to move larger files, which reduces dependence on Discord if the accounts are shut down.
    • Discord traffic is not blocked by default and is rarely treated as C2, so the operators need no dedicated infrastructure.

    Remediation

    • The article gives no explicit remediation steps.
    • Defenders should consider monitoring for Discord and Ngrok traffic that is unexpected for the environment.
    • Defenders should also watch for disk images and LNK files executing PowerShell, computerdefaults.exe registry abuse, and an unexpected dbghelp.dll in the Edge installation directory.