CikaBika Bot RAT Uses Discord for C&C

The CikaBika Bot RAT campaign involves phishing attacks delivering a PDF file that contains a disk image with a Windows shortcut posing as a Word document. When opened, it launches a hidden PowerShell process that decodes and runs an embedded executable loader written in Nim, which deploys a Rust DLL and PowerShell script. The script attempts to move the DLL into the protected Microsoft Edge directory to bypass UAC and uses DLL search-order hijacking to sideload malicious code. Once active, the RAT registers the infected machine with Discord, using Discord channels as the interactive C&C interface. The RAT supports reconnaissance (system info, processes, network config, screenshots), command execution, process termination, file operations, and surveillance (camera, streaming). It can compress directories into ZIP archives and exfiltrate data via Ngrok. This use of legitimate platforms for C&C and exfiltration complicates detection and attribution.

The malware enables attackers to gain persistent remote access to infected systems, perform reconnaissance, execute arbitrary commands, manage processes, and exfiltrate sensitive data. Its use of Discord for C&C and Ngrok for data exfiltration leverages trusted services, potentially bypassing traditional network defenses. The infection chain includes techniques to evade User Account Control and detection, increasing the risk of successful compromise and data theft.

No official vendor advisory or patch information is available for this malware. Mitigation should focus on user awareness to prevent phishing infections, blocking malicious document attachments, and monitoring for unusual use of Discord and Ngrok services within the network. Endpoint detection and response solutions should be tuned to detect suspicious PowerShell activity, DLL sideloading, and unauthorized use of protected directories. Network monitoring for anomalous Discord and Ngrok traffic may help identify infections. Since this is malware, remediation involves incident response and system cleanup rather than patching.