CikaBika Bot RAT Exploits Discord for Command-and-Control

• •CikaBika Bot uses Discord for command-and-control operations.
• •The malware is distributed via phishing attacks using document-themed lures.
• •Attackers can execute commands and exfiltrate data from infected systems.

Darktrace has identified a malware campaign utilizing the CikaBika Bot, a Rust-based remote access trojan (RAT) that employs Discord for command-and-control (C&C). The malware is distributed via phishing attacks featuring document-themed lures, including a malicious Windows shortcut disguised as a Word document. Once activated, it executes a hidden PowerShell process to decode and run an embedded executable, which is a Nim-based loader. This loader attempts to sideload a Rust DLL into the Microsoft Edge directory, bypassing User Account Control (UAC). The RAT enables attackers to conduct reconnaissance, execute commands, and exfiltrate data, with commands transmitted through Discord channels. The campaign highlights the increasing misuse of legitimate platforms for malicious activities. There are no specific CVEs mentioned, and the full scope of the impact remains unclear.