CikaBika Bot: New Malware Uses Discord to Control Infected Devices

How the CikaBika Bot Attack Works

According to SecurityWeek↗ (opens in a new tab), researchers at Darktrace have found a new malware campaign using a remote access trojan (RAT) called CikaBika Bot. This malware is written in Rust and is being spread through phishing emails. The emails use document-themed lures to trick people into opening a file that looks like a Word document.

Victims receive a PDF file. Inside it is a disk image containing a Windows shortcut (LNK file) that pretends to be a Word document. When someone opens the shortcut, it shows a decoy document but also secretly runs a PowerShell script in the background. This script decodes and runs a hidden program on the victim's computer.

The hidden program is a loader (a small program that loads other software), written in Nim. It drops a Rust-based DLL (a type of Windows program) and another PowerShell script onto the system. The script tries to move the DLL into the Microsoft Edge browser's directory, which is protected by Windows User Account Control (UAC). This is an attempt to bypass security checks.

Researchers believe the attackers use a technique called DLL search-order hijacking. This means they put their malicious DLL where Windows will load it instead of the real one, by mimicking functions from Microsoft's debugging library.

What the Malware Does

Once installed, the CikaBika Bot RAT registers the infected computer with Discord. Discord, usually used for chat and gaming, is repurposed here as a command-and-control (C&C) channel. This means the attackers can send commands and receive data through Discord, blending in with normal internet traffic.

The malware starts by collecting information about the victim's system, running processes, and network setup. It also takes a screenshot. The attacker can then use Discord to:

• Run commands on the victim's computer
• List or kill running processes
• Upload or download files
• Take screenshots or use the camera for surveillance
• Stream or broadcast from the victim's device

For stealing files, the malware can compress folders into ZIP files and send them out using a service called Ngrok, which helps bypass firewalls and network restrictions. Attackers can also request specific files from the victim's system.

Why Discord and Ngrok?

Using Discord for C&C makes it harder for defenders to spot the attack. Many organisations allow Discord traffic, and the malware's communication looks like normal chat activity. Ngrok is a legitimate tool for secure tunnelling, but here it is used to sneak stolen data out of the network.

Darktrace notes that this shows how attackers can abuse popular, trusted services to hide their activity and avoid detection.

What to Watch For and What to Do

The attack starts with a phishing email and a fake document. Be wary of unexpected attachments, especially those that ask you to open files that seem out of place or require extra steps (like opening a disk image or shortcut). Security teams should monitor for unusual use of Discord and Ngrok on their networks, and check for suspicious PowerShell activity or unknown DLLs in protected directories.

At the time of writing, only SecurityWeek↗ (opens in a new tab) has reported this campaign, citing Darktrace. There are no public statements from Discord or law enforcement, and the scale of the attack is not yet clear.