Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).
Dubbed CikaBika Bot, the malware has been distributed via document-themed lures, likely as part of phishing attacks, and provides attackers with reconnaissance, remote execution, and data exfiltration capabilities on infected systems.
Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.
The executable is a Nim-based loader containing a Rust DLL and a PowerShell deployment script that are written to temporary files. The script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).
According to Darktrace, the attackers likely attempt to sideload the malicious code through DLL search-order hijacking by exporting functions associated with Microsoft’s debugging library.
The final payload is the CikaBika Bot RAT, which immediately registers the infected machine with Discord and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking a screenshot.
Commands and reports are transmitted via Discord, which is used as an interactive interface. The operator can issue command execution, reconnaissance, process enumeration/termination, file upload/download, and surveillance (screenshot, camera, streaming, and broadcasting) commands.
According to Darktrace, the attackers can use the RAT to compress directories into ZIP archives and exfiltrate them via Ngrok, and can request specific documents from the victim’s system.
“The observed use of Discord channels for individual victims, alongside additional data exfiltration through Ngrok, shows how legitimate services can be repurposed to support malicious operations,” Darktrace notes.
Related: XWorm RAT Evolves Into Surveillance Platform
Related: In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
