Darktrace has identified a novel cyber threat involving a Rust-coded remote access trojan (RAT) known as CikaBika Bot. This malware utilizes Discord as its command-and-control (C&C) platform, posing significant risks to affected systems.
Phishing Tactics and Initial Infection
CikaBika Bot is propagated through document-themed phishing lures, which are designed to deceive users into initiating the malware. Victims typically receive a PDF file that contains a disk image, which masquerades as a Word document. When opened, this triggers the display of a decoy document while discreetly activating a PowerShell process that decodes and executes embedded malicious code.
The malware employs a Nim-based loader, which carries a Rust DLL and a PowerShell script. These components are temporarily stored and the script attempts to relocate the DLL into the Edge browser’s protected directory, effectively circumventing Windows User Account Control (UAC) safeguards.
Mechanisms of Exploitation
Darktrace reports that attackers likely sideload the malicious DLL using search-order hijacking, leveraging functions from Microsoft’s debugging library. This method allows the RAT to embed itself deeply within the system, enhancing its persistence and stealth.
Upon successful deployment, the CikaBika Bot RAT registers the compromised device with Discord. It immediately initiates reconnaissance activities, gathering information about the system, running processes, and network configurations, alongside capturing screenshots.
Command and Control via Discord
The use of Discord as a C&C interface enables attackers to issue a variety of commands remotely. This includes executing commands, listing and terminating processes, uploading and downloading files, and conducting surveillance through screenshots and potential camera access.
Additionally, the malware can compress directories into ZIP files and extract them using Ngrok, a service that facilitates secure tunneling. It can also specifically target and retrieve documents from the victim’s system, further emphasizing the threat it poses to sensitive data.
Darktrace highlights the innovative misuse of legitimate services such as Discord and Ngrok to support these malicious operations, illustrating the evolving tactics of cybercriminals.
Implications and Future Considerations
The emergence of CikaBika Bot underscores the need for heightened vigilance and robust cybersecurity measures. As attackers continue to exploit widely-used platforms like Discord, organizations must adapt and strengthen their defenses to protect against such sophisticated threats.
Ongoing research and threat analysis are crucial in understanding the full capabilities of malware like CikaBika Bot. Staying informed on these developments is essential for both individuals and businesses aiming to safeguard their digital environments.
