DARKTRACE has uncovered a campaign distributing a Rust-based remote access trojan, dubbed CikaBika Bot, which uses Discord for its command-and-control communications. The malware is delivered through document-themed phishing lures. Victims receive a PDF containing a disk image with a Windows LNK file masquerading as a Word document. When opened, the decoy document is shown and a hidden PowerShell process decodes and runs an embedded executable.
The embedded loader is Nim-based and writes a Rust DLL and a PowerShell deployment script to temporary files. The script attempts to move the DLL into the protected Edge directory in a bid to bypass UAC, and Darktrace suggests the operators likely rely on DLL search-order hijacking by exporting functions tied to Microsoft’s debugging library.
The final payload registers with Discord and begins its reconnaissance: it harvests system information, enumerates processes and network configuration, and can take screenshots. Commands and exfiltration are carried out via Discord, with capabilities including remote execution, file upload/download, and surveillance (including camera access and streaming). The operators can compress directories to ZIP archives and exfiltrate them through Ngrok, and may request specific documents from the victim’s system.
The report notes this as an example of legitimate services being repurposed to support malicious operations, underlining the need for vigilance around tool usage in phishing chains. Practical responses should follow standard malware containment, user education on phishing, and monitoring for unusual Discord-based C&C activity and Ngrok tunneling.