CikaBika RAT Abuses Discord and Ngrok for Remote Access and Data Theft
A new Rust-based remote access trojan uses Discord for command-and-control and Ngrok for exfiltrating stolen data from compromised Windows systems.
Key points
- CikaBika Bot is a Rust-based RAT distributed via phishing lures that use PDFs containing malicious shortcuts.
- The malware uses Discord channels for command-and-control and Ngrok for exfiltrating compressed directories.
- Attackers attempt to bypass User Account Control by moving a malicious DLL into the Edge directory.
Darktrace identified a new malware campaign distributing CikaBika Bot, a remote access trojan written in Rust. The group uses Discord as its command-and-control infrastructure. The malware targets Windows systems through phishing attacks that deliver document-themed lures. Once executed, the code provides reconnaissance, remote execution, and data exfiltration capabilities to the attackers.
How it unfolded
- Victims receive a PDF file containing a disk image with a Windows shortcut posing as a Word document.
- Opening the shortcut displays a decoy document and launches a hidden PowerShell process to decode an embedded executable.
- The Nim-based loader writes a Rust DLL and PowerShell script to temporary files, then moves the DLL to the Edge directory.
- The final payload registers the machine with Discord and begins harvesting system information, processes, and network configuration.
Who is affected
Organisations targeted by phishing campaigns involving fake document attachments are at risk. The malware specifically targets Windows environments. According to Darktrace, the attackers can request specific documents from the victim’s system. The use of individual Discord channels for each victim suggests a structured approach to managing multiple compromised machines simultaneously.
The fix
No patch or fix has been confirmed yet. Users should remain vigilant against unexpected document attachments. Security teams should monitor for unusual PowerShell activity and connections to Discord servers from internal endpoints. Blocking unauthorised Ngrok tunnels may help prevent data exfiltration attempts associated with this campaign.
What analysts watch for
Teams usually investigate unexpected outbound connections to communication platforms like Discord. Analysts check whether legitimate applications are being used for command-and-control traffic. They examine temporary directories for newly created scripts or libraries. Persistence mechanisms often involve moving files into protected system folders. Teams verify if User Account Control bypass techniques were employed. They also monitor for compressed archives being created or transmitted unexpectedly.
What to do and how to stay safe: CikaBika Bot
- Monitor network logs for unusual outbound connections to Discord servers or Ngrok domains.
- Inspect email attachments for PDFs containing disk images or unexpected shortcut files.
- Review PowerShell execution logs for hidden processes or encoded commands running in the background.
- Check temporary directories for newly created DLLs or scripts that do not match known applications.
Step-by-step guide: Ransomware Incident Response: Steps to Contain and Recover
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How is CikaBika Bot typically delivered to victims?
It is distributed via phishing attacks using PDF files that contain a disk image with a malicious Windows shortcut.
What role does Discord play in this malware campaign?
Discord is used as the command-and-control interface, allowing operators to issue commands and receive reports from infected systems.
How do the attackers exfiltrate data from compromised machines?
Attackers compress directories into ZIP archives and exfiltrate them via Ngrok, while also requesting specific documents directly.
