CikaBika RAT Uses Discord for Command and Control
Summary
Darktrace reports a campaign delivering the Rust-based CikaBika RAT through document-themed lures. The malware uses Discord for command and control and can collect system data, execute commands, and exfiltrate files via Ngrok.
Key points
- The campaign uses PDF lures containing a disk image and a Windows shortcut disguised as a Word document; opening it launches a hidden PowerShell process.
- A Nim-based loader writes a Rust DLL and PowerShell deployment script to temporary files, then attempts to place the DLL in Edge’s protected directory to bypass UAC.
- Darktrace says the attackers likely use DLL search-order hijacking to sideload the malicious code.
- The RAT registers infected machines with Discord and collects system details, processes, network configuration, and screenshots.
- Operators can execute commands, manage processes, transfer files, and request surveillance functions including camera access and streaming.
- The attackers can compress directories into ZIP archives and exfiltrate them via Ngrok, according to Darktrace.
Article Details
- Attack Vectors
- Document-themed lures deliver a PDF containing a disk image with a Windows shortcut (LNK) disguised as a Word document.
- Opening the shortcut displays a decoy document and launches hidden PowerShell to decode and run an embedded executable.
- The executable is a Nim-based loader that writes a Rust DLL and PowerShell deployment script to temporary files.
- The deployment script attempts to move the DLL into the protected Edge directory; Darktrace says the attackers likely attempt DLL search-order hijacking by exporting functions associated with Microsoft’s debugging library.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe RAT collects network configuration information from infected systems.T1041 · Exfiltration Over C2 ChannelDarktrace reports that the attackers can exfiltrate ZIP archives through Ngrok.T1057 · Process DiscoveryThe RAT enumerates processes during reconnaissance and supports process enumeration commands.T1059.001 · PowerShellA hidden PowerShell process decodes and runs an embedded executable, and a PowerShell deployment script writes the DLL and script to temporary files.T1071.001 · Web ProtocolsCikaBika Bot uses Discord to transmit commands and reports and to provide an interactive operator interface.T1082 · System Information DiscoveryThe RAT harvests system information from infected machines.T1105 · Ingress Tool TransferThe operator can use the RAT to upload and download files.T1113 · Screen CaptureThe RAT takes screenshots and supports screenshot commands.T1204.002 · Malicious FileThe infection chain begins when a victim opens the LNK posing as a Word document.T1548.002 · Bypass User Account ControlThe deployment script attempts to move the DLL into the protected Edge directory to bypass Windows User Account Control.T1560.001 · Archive via UtilityThe attackers can use the RAT to compress victim directories into ZIP archives.T1566.001 · Spearphishing AttachmentThe malware was distributed through document-themed lures, likely as part of phishing attacks, with a PDF containing a disguised LNK.T1574.002 · DLL Side-LoadingDarktrace says the attackers likely attempt DLL search-order hijacking, using a DLL that exports functions associated with Microsoft’s debugging library.
Malware
Products
DiscordDarktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).EdgeThe script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).Microsoft WindowsVictims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document.NgrokAccording to Darktrace, the attackers can use the RAT to compress directories into ZIP archives and exfiltrate them via Ngrok, and can request specific documents from the victim’s system.