Back Securityweek

CikaBika Bot RAT Uses Discord for C&C

Securityweek •Ionut Arghire • October 15, 2026

Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).

Dubbed CikaBika Bot , the malware has been distributed via document-themed lures, likely as part of phishing attacks, and provides attackers with reconnaissance, remote execution, and data exfiltration capabilities on infected systems.

Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.

The executable is a Nim-based loader containing a Rust DLL and a PowerShell deployment script that are written to temporary files. The script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).

According to Darktrace, the attackers likely attempt to sideload the malicious code through DLL -order hijacking by exporting functions associated with Microsoft’s debugging library.

The final payload is the CikaBika Bot RAT, which immediately registers the infected machine with Discord and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking a screenshot.

Commands and reports are transmitted via Discord, which is used as an interactive interface. The operator can issue command execution, reconnaissance, process enumeration/termination, file upload/download, and surveillance (screenshot, camera, streaming, and broadcasting) commands.

According to Darktrace, the attackers can use the RAT to compress directories into ZIP archives and exfiltrate them via Ngrok, and can request specific documents from the victim’s system.

“The observed use of Discord channels for individual victims, alongside additional data exfiltration through Ngrok, shows how legitimate services can be repurposed to support malicious operations,” Darktrace notes.

Related: XWorm RAT Evolves Into Surveillance Platform

Related: In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years

Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CikaBika Bot RAT Exploits Discord for Command-and-Control Darktrace has identified a malware campaign utilizing the CikaBika Bot, a Rust-based remote access trojan (RAT) that employs Discord for command-and-control (C&C). The malware is distributed via phishing attacks featuring document-themed lures, including a malicious Windows shortcut disguised as a Word document. Once activated, it executes a hidden PowerShell process to decode and run an embedded executable, which is a Nim-based loader. This loader attempts to sideload a Rust DLL into the Microsoft Edge directory, bypassing User Account Control (UAC). The RAT enables attackers to conduct reconnaissance, execute commands, and exfiltrate data, with commands transmitted through Discord channels. The campaign highlights the increasing misuse of legitimate platforms for malicious activities. There are no specific CVEs mentioned, and the full scope of the impact remains unclear. 2 sources 37

Extracted Entities

CikaBika Bot RAT Uses Discord for C&C

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (4)

Platforms (2)

Tools (2)