CikaBika RAT Abuses Discord and Ngrok to Evade Detection
The CikaBika Bot campaign highlights how threat actors exploit legitimate platforms like Discord and Ngrok to blend malicious command-and-control traffic with normal network activity, making detection significantly harder. The malware is delivered through phishing lures disguised as documents, exploiting user trust and insufficient email filtering controls. A multi-stage infection chain using a Nim-based loader and PowerShell scripts allows attackers to bypass User Account Control (UAC) and establish persistence on victim systems. This matters because abusing trusted cloud services undermines traditional blocklist-based defenses, and UAC bypass techniques allow attackers to escalate privileges with minimal friction. Organizations without behavioral monitoring or strict application controls are especially vulnerable to this type of layered attack.
Tactical Insight
Immediate actions
- Block or strictly monitor outbound connections to Ngrok endpoints and unauthorized Discord API traffic at the perimeter firewall.
- Deploy advanced email filtering with sandboxing to detonate document-themed phishing attachments before they reach end users.
- Audit and restrict PowerShell execution policies using Constrained Language Mode or AppLocker to limit script-based attacks.
Long-term improvements
- Implement application allowlisting to prevent unauthorized loaders (e.g., Nim-based binaries) from executing on endpoints.
- Enforce the principle of least privilege so that standard user accounts cannot trigger UAC bypass techniques or install persistence mechanisms.
- Conduct regular phishing simulation training to improve employee ability to identify document-lure social engineering attacks.
Detection measures
- Enable behavioral endpoint detection (EDR) rules to flag anomalous PowerShell spawning, UAC bypass attempts, and unexpected outbound tunneling traffic.
- Monitor DNS and network logs for connections to known tunneling services (Ngrok, Cloudflare Tunnel) originating from non-approved hosts.
- Establish SIEM correlation rules that alert on multi-stage indicators: phishing email delivery, script execution, and subsequent C&C beacon patterns.