CikaBika Bot RAT Leverages Discord for Command and Control
A new Rust-based Remote Access Trojan (RAT) named CikaBika Bot is utilizing Discord for its command-and-control (C&C) infrastructure, enabling sophisticated reconnaissance, remote execution, and data exfiltration.
Security researchers at Darktrace have identified a novel malware campaign employing a Rust-based Remote Access Trojan (RAT) that ingeniously uses Discord as its command-and-control (C&C) platform. This malware, dubbed CikaBika Bot, is being distributed through phishing attacks, often disguised as document-themed lures, to compromise victim systems.
The initial infection vector involves victims receiving a PDF file containing a disk image. Upon opening this image, a Windows shortcut (LNK) file, masquerading as a Microsoft Word document, is presented. When executed, this shortcut displays a decoy document to the user while simultaneously launching a hidden PowerShell process. This process is responsible for decoding and executing an embedded executable payload.
The embedded executable is a Nim-based loader that unpacks a Rust DLL and a PowerShell deployment script. These components are written to temporary files on the victim's system. The PowerShell script then attempts to elevate its privileges and evade detection by moving the malicious DLL into the protected Microsoft Edge directory, aiming to bypass Windows User Account Control (UAC).
According to Darktrace's analysis, the attackers likely employ DLL search-order hijacking techniques. By exporting functions commonly associated with Microsoft's debugging libraries, they aim to trick the system into loading the malicious Rust DLL when legitimate debugging or Edge-related processes are initiated, thereby sideloading the RAT.
Once successfully loaded, the CikaBika Bot RAT establishes communication with its C&C server, which in this case is a Discord channel. The malware immediately begins its reconnaissance phase, collecting sensitive information about the infected machine. This includes system details, running processes, network configuration, and even capturing screenshots to provide the attacker with a visual overview of the compromised environment.
Discord serves as the primary interactive interface for the threat actors. Through dedicated Discord channels, operators can issue a wide range of commands to the infected machine. These commands include executing arbitrary code, performing further reconnaissance, enumerating and terminating processes, uploading and downloading files, and conducting surveillance operations such as capturing screenshots, accessing the webcam, and streaming live video.
Beyond its C&C functions, CikaBika Bot possesses robust data exfiltration capabilities. The RAT can compress specified directories into ZIP archives and exfiltrate them using Ngrok, a service that creates secure tunnels to expose local servers to the internet. Attackers can also specifically request particular documents from the victim's system, indicating a targeted approach to data theft.
The use of legitimate, widely-used services like Discord for C&C and Ngrok for data exfiltration highlights a growing trend among threat actors to blend malicious activities with normal network traffic, making detection more challenging. This tactic leverages the ubiquity and perceived trustworthiness of these platforms to mask their malicious operations.