[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpNojp1Vm_dZhKjsoqMBaAcxk6fVF-3VEYvVzCqAaWmM":3},{"article":4,"iocs":47,"watch_terms":58,"solutions":59,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"6b791250-a364-4527-af14-8773c63a7ea2","CikaBika Bot RAT Uses Discord for C&C","cikabika-bot-rat-uses-discord-for-c-c-60f1b8","Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities. The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.","A new malware campaign has been uncovered by Darktrace, distributing a Rust-based Remote Access Trojan (RAT) named CikaBika Bot. This malware leverages Discord for its command-and-control (C&C) infrastructure and Ngrok for data exfiltration. It is delivered via phishing attacks using document-themed lures, employing a Nim-based loader and PowerShell scripts to bypass UAC and achieve persistence.","CikaBika Bot RAT, a new Rust-based malware, uses Discord for C&C and Ngrok for data exfiltration.","https:\u002F\u002Fwww.securityweek.com\u002Fcikabika-bot-rat-uses-discord-for-cc\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002Fmalware.jpeg","2026-10-15T11:25:58+00:00","2026-10-15T12:00:11.98829+00:00",8,[17,20,22,24,26],{"name":18,"type":19},"Discord","product",{"name":21,"type":19},"Ngrok",{"name":23,"type":19},"PowerShell",{"name":25,"type":19},"Microsoft Edge",{"name":27,"type":28},"Darktrace","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,51,55],{"type":33,"value":49,"context":50},"CikaBika Bot RAT","Name of the malware discovered",{"type":52,"value":53,"context":54},"domain","discord.com","Used for Command and Control (C&C)",{"type":52,"value":56,"context":57},"ngrok.io","Used for data exfiltration",[27,18,21],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[149],{"slug":150,"name":27,"logo_path":151,"roles":152},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":171},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","The CikaBika Bot campaign highlights how threat actors exploit legitimate platforms like Discord and Ngrok to blend malicious command-and-control traffic with normal network activity, making detection significantly harder. The malware is delivered through phishing lures disguised as documents, exploiting user trust and insufficient email filtering controls. A multi-stage infection chain using a Nim-based loader and PowerShell scripts allows attackers to bypass User Account Control (UAC) and establish persistence on victim systems. This matters because abusing trusted cloud services undermines traditional blocklist-based defenses, and UAC bypass techniques allow attackers to escalate privileges with minimal friction. Organizations without behavioral monitoring or strict application controls are especially vulnerable to this type of layered attack.",[159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AU-12 – Audit Record Generation","MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols (C&C via Discord)","MITRE ATT&CK T1548.002 – Abuse Elevation Control Mechanism: UAC Bypass","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","NIST CSF DE.CM-1 – Network Communications Monitoring",{}]