Darktrace Details CikaBika Rust RAT Using Discord for Command and Control
Summary
Darktrace researchers detail CikaBika, a Rust RAT delivered through a document-themed disk image and Nim loader. It uses Discord for C2; observed operator activity included command execution and data exfiltration via ngrok.
Key points
- The delivery method is unconfirmed; researchers found a disk image containing a decoy PDF and a Windows shortcut disguised as a Word document.
- The shortcut launches hidden PowerShell, which decodes and executes a Nim-based loader.
- The loader attempts a PowerShell UAC bypass to plant a DLL in Microsoft Edge's installation directory; the analysis shows the intended sideloading route, but not that Edge successfully loaded the DLL.
- The Rust RAT gathers host, process, and network information, attempts screenshots, and supports remote commands and file transfers.
- CikaBika uses dedicated Discord channels to register devices, receive commands, and return results.
- In observed activity, the operator compressed a directory and exfiltrated it using ngrok; the RAT can also return selected files through Discord.
Article Details
- Attack Vectors
- A disk image contained a malicious Windows shortcut disguised as a Word document and a PDF decoy; the delivery method was not confirmed.
- The shortcut launched hidden PowerShell, which decoded an embedded executable using an XOR key and ran it.
- A Nim loader deployed a Rust DLL and used a PowerShell-mediated registry change to attempt a UAC bypass and place the DLL in Microsoft Edge’s installation directory.
- The DLL was designed to exploit Edge’s dbghelp.dll dependency through DLL search-order hijacking; successful loading was not confirmed.
- CikaBika Bot used dedicated Discord channels for command-and-control, host reconnaissance, remote commands, and file transfers.
- In observed activity, the operator compressed a directory into a ZIP and exfiltrated it using ngrok.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 2deb724a709b0b892248405323350e9b | MD5 hash listed for IfyuUapz.txt, the Nim-based loader. |
| MD5 | 62e3e85eca78a0cd7e6669e9f33d936d | MD5 hash listed for the malicious shortcut, Proposition_Projet_Personnalisable.docx.lnk. |
| MD5 | c66858718d883bcfb9ce2c19b59f96c9 | MD5 hash listed for the malicious dbghelp.dll associated with the RAT. |
| MD5 | eeb52cb95113a131c2c7713c17872da6 | MD5 hash listed for the PDF decoy, Presentation_Generale.pdf.pdf, in the campaign's indicators of compromise. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe RAT runs ipconfig to obtain network configuration.T1027 · Obfuscated Files or InformationThe shortcut uses an XOR key to decode an executable embedded in the PDF; the loader also contains Base64-encoded DLL and PowerShell script blobs.T1036.005 · Match Legitimate Resource Name or LocationThe malicious DLL is named dbghelp.dll and is placed in Edge’s installation directory to resemble the legitimate library.T1057 · Process DiscoveryThe RAT runs tasklist and provides commands for process enumeration.T1059.001 · PowerShellPowerShell decodes and executes the embedded payload and runs the deployment script.T1059.003 · Windows Command ShellThe operator can use the RAT's !shell command for remote command execution.T1082 · System Information DiscoveryCikaBika Bot collects host and system details during reconnaissance.T1102.002 · Bidirectional CommunicationThe RAT uses dedicated Discord channels for two-way command exchange and reporting results.T1112 · Modify RegistryThe deployment script modifies HKCU\Software\Classes\ms-settings\shell\open\command as part of its UAC-bypass attempt.T1113 · Screen CaptureThe RAT attempts to capture a screenshot and includes a screenshot command handler.T1140 · Deobfuscate/Decode Files or InformationThe shortcut decodes the embedded executable, and the Nim loader decodes its Base64-encoded DLL and deployment script.T1204.002 · Malicious FileOpening the malicious Windows shortcut launches the hidden PowerShell process.T1548.002 · Bypass User Account ControlThe PowerShell deployment script attempts a UAC bypass by changing a registry key and triggering computerdefaults.exe.T1567 · Exfiltration Over Web ServiceIn observed activity, the operator exfiltrated a compressed directory using ngrok.T1574.001 · DLLThe loader attempts to place a malicious dbghelp.dll in Microsoft Edge’s installation directory to exploit DLL search-order behavior.
Malware
Products
Discord· The RAT uses Discord for C2, creating dedicated channels to manage infected devices and execute commands.Microsoft Edge· The Nim based loader deploys a Rust-based remote access trojan (RAT), using a UAC bypass and DLL search-order hijacking technique targeting Microsoft Edge.Microsoft Windowsa Rust-based RAT that uses Discord for C2. The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s