Cybersecurity researchers at Darktrace have uncovered a sophisticated and stealthy new malware campaign distributing a Rust-based Remote Access Trojan (RAT) that uniquely leverages legitimate platforms, including Discord and Ngrok, for command-and-control operations and data exfiltration.
Tracked by security analysts as the CikaBika Bot, the malware is currently being distributed through document-themed lures, likely as part of broader phishing campaigns targeting unsuspecting users. Once a system is successfully compromised, the RAT equips malicious actors with an extensive array of capabilities, ranging from comprehensive reconnaissance and remote execution to targeted data harvesting and aggressive exfiltration on infected systems.
The multi-stage attack chain begins when potential victims receive a malicious PDF file containing a disk image. Inside this disk image lies a Windows shortcut file, commonly known as an LNK file, cleverly disguised to mimic a legitimate Microsoft Word document. When the unsuspecting user opens the file, it immediately displays a benign decoy document to maintain the illusion of legitimacy. Behind the scenes, however, the shortcut covertly launches a hidden PowerShell process designed to decode and execute an embedded executable file.
This primary executable functions as a Nim-based loader, containing both a Rust-based DLL and a secondary PowerShell deployment script that are swiftly written to temporary system directories on the machine. The deployment script then initiates a tactical maneuver, attempting to move the malicious DLL into the protected Microsoft Edge directory. According to Darktrace, this deliberate placement is engineered to bypass Windows User Account Control (UAC) security measures by leveraging the trusted application environment.
Security analysts at Darktrace indicate that the attackers likely attempt to sideload the malicious code through DLL search-order hijacking. By exporting functions specifically associated with Microsoft’s debugging library, the malware manages to blend its operations into routine system behaviors, evading immediate detection by traditional security controls deployed on the host system.
The culmination of this intricate delivery mechanism is the CikaBika Bot RAT itself. Upon successful execution on the target machine, the malware immediately registers the newly infected host with Discord, establishing a persistent communication channel. It then initiates an automated reconnaissance routine, systematically harvesting detailed system information, running processes, and network configurations, while simultaneously capturing a screenshot of the user’s active desktop environment.
The operational architecture of the CikaBika Bot relies heavily on Discord channels to serve as an interactive user interface for the human operators. Commands and detailed status reports are transmitted seamlessly via the platform. Through this channel, the operator can issue a wide variety of intrusive commands, including remote command execution, deeper system reconnaissance, process enumeration and termination, file upload and download operations, and comprehensive surveillance activities that incorporate screenshots, web camera access, live video streaming, and desktop broadcasting.
Furthermore, Darktrace’s analysis revealed that the threat actors behind the CikaBika Bot can utilize the RAT to compress entire system directories into ZIP archives. Once packaged, these archives are exfiltrated from the victim’s network via Ngrok, a legitimate tunneling service often abused by malicious actors to bypass corporate firewalls and conceal the destination of stolen data. In addition to bulk data theft, the operators retain the capability to request specific individual documents directly from the victim’s local storage.
Highlighting the evolving tactics observed in the threat landscape, Darktrace noted in its technical evaluation of the campaign that the abuse of trusted infrastructure remains a preferred strategy for modern cybercriminals. The observed reliance on dedicated Discord channels for individual victim management, combined with supplemental data exfiltration channels through Ngrok, vividly demonstrates how legitimate enterprise and consumer services are routinely repurposed to support and conceal malicious cyber operations.
The emergence of the CikaBika Bot adds to a growing trend of threat actors adopting memory-safe programming languages like Rust and Nim for malware development, aiming to complicate reverse engineering efforts and evade signature-based detection mechanisms. As security researchers continue to dissect campaigns utilizing multi-tiered loaders and living-off-trusted-sites techniques, organizations are reminded of the critical need for advanced behavioral monitoring and comprehensive endpoint visibility to detect anomalous activities before sensitive data is compromised.
