CikaBika Bot RAT Uses Discord for C&C
CikaBika Bot RAT, a new Rust-based malware, uses Discord for C&C and Ngrok for data exfiltration.
Run Darktrace?
Get an email when a reviewed story names Darktrace, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A new malware campaign has been uncovered by Darktrace, distributing a Rust-based Remote Access Trojan (RAT) named CikaBika Bot. This malware leverages Discord for its command-and-control (C&C) infrastructure and Ngrok for data exfiltration. It is delivered via phishing attacks using document-themed lures, employing a Nim-based loader and PowerShell scripts to bypass UAC and achieve persistence.
The lesson from this incident
Full lessonThe CikaBika Bot campaign highlights how threat actors exploit legitimate platforms like Discord and Ngrok to blend malicious command-and-control traffic with normal network activity, making detection significantly harder. The malware is delivered through phishing lures disguised as documents, exploiting user trust and insufficient email filtering controls. A multi-stage infection chain using a Nim-based loader and PowerShell scripts allows attackers to bypass User Account Control (UAC) and establish persistence on victim systems. This matters because abusing trusted cloud services undermines traditional blocklist-based defenses, and UAC bypass techniques allow attackers to escalate privileges with minimal friction. Organizations without behavioral monitoring or strict application controls are especially vulnerable to this type of layered attack.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
- malware — CikaBika Bot RAT
- domain — discord.com
- domain — ngrok.io