- Darktrace found CikaBika Bot, a Rust-based remote access trojan that uses Discord channels, one per infected device, to receive attacker commands.
- In this campaign the attacker did not need a dedicated command server, so a list of known bad servers gives defenders less to work with.
- Ask whether your tools flag odd processes, hidden PowerShell and shortcut files in disk images, not only unknown servers.
The attacker rents the control room
Most malware needs a home base. The attacker must run a server, keep it online and hope defenders do not find it. Darktrace's researchers describe a campaign that skips that step. The malware, called CikaBika Bot, takes its orders from Discord, a mainstream chat service.
The idea worth taking from this case is that the control room can sit inside a platform many people already know. In this campaign the attacker did not need to run or maintain a dedicated command server, so there was no dedicated command server to take down. A list of known bad servers gives a defender less to work with here.
How the infection runs
The chain starts with a disk image named Proposition_Projet.img. Inside are a PDF and a Windows shortcut dressed up as a Word document. Darktrace has not confirmed how the file reaches victims. It says the filenames and document-themed lure fit a phishing campaign.
Opening the shortcut starts a hidden PowerShell process. The victim sees a French-language PDF about writing a text summary. Behind it, PowerShell decodes an executable hidden inside that same PDF and runs it.
That program is a loader written in Nim, a less common programming language. It holds two encoded items: a Rust library file and a PowerShell script. The script tries to place the library in Microsoft Edge's installation folder as dbghelp.dll. To get past Windows User Account Control, it edits a registry entry and then launches a built-in Windows tool. The script launches its bypass helper three times, then checks whether the file landed and tries to delete its own traces.
The aim is called DLL search-order hijacking. Edge loads a debugging library by that name. A planted copy in the right folder can be loaded in its place. Darktrace adds limits. The fake library does not cover every function Edge expects. The bypass also depends on how the target's Windows is configured. The code shows the intended route, not proof that Edge loaded the file.
One channel per victim
Once running, the Rust tool registers the device with Discord. The message records a device ID, hostname, public and private IP addresses, uptime and the channel assigned to that machine. It also runs tasklist and ipconfig and tries to take a screenshot.
From there the operator types commands into the victim's channel and reads the replies in the same thread. Commands include remote shell access, process listing and termination, and file upload and download. Strings in the code also mention camera access and streaming.
Darktrace saw the attacker compress a directory into a ZIP and send it out through ngrok, a tunnelling service. The operator also used the download command to pull a specific file from a victim's desktop.
Why behaviour matters as much as destination
Blocking unknown servers is a common control. Here the commands travel through Discord, a mainstream chat service, so the destination alone says little about intent. Think of someone who rents a mailbox at a public post office instead of building a private one.
That shifts attention from where traffic goes to what the device does. Here the clues are in the behaviour. A shortcut file launches hidden PowerShell. A temporary file is run through cmd. A registry key tied to ms-settings is modified. A new DLL appears in the Edge folder. Darktrace maps these steps to named techniques and publishes file hashes in its report.
Darktrace's own conclusion is that the case shows how legitimate services can be repurposed. Our view is narrower. In this campaign the attacker did not need to run a command server. The attacker still used ngrok for exfiltration, and Discord could remove the channels or accounts involved. The report does not say whether it has.
Questions to put to your security team
First, can we see hidden PowerShell launches and registry changes under the ms-settings path on laptops? Second, do we alert on disk image or shortcut files arriving by email or download? Third, do we know which staff genuinely need Discord, and who could do without it? Fourth, can we spot a large archive leaving a laptop for a tunnelling service?
Ask for answers on real devices, not policy documents. Darktrace's indicators include file hashes and the names of the lure files, which your team can check against logs.
When the control room is rented, the endpoint is where the attacker's actions become visible.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Darktrace.
