Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).
Dubbed CikaBika Bot, the malware has been distributed via document-themed lures, likely as part of phishing attacks, and provides attackers with reconnaissance, remote execution, and data exfiltration capabilities on infected systems.
Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.
The executable is a Nim-based loader containing a Rust DLL and a PowerShell deployment script that are written to temporary files. The script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).
According to Darktrace, the attackers likely attempt to sideload the malicious code through DLL search-order hijacking by exporting functions associated with Microsoft’s debugging library.
The final payload is the CikaBika Bot RAT, which immediately registers the infected machine with Discord and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking a screenshot.