Rust-Based CikaBika Bot Turns Discord into a Command Center
What Happened – Darktrace researchers uncovered a new remote‑access trojan, CikaBika Bot, written in Rust. The malware is delivered via a malicious disk image and Windows shortcut, uses a Nim loader, performs a PowerShell UAC bypass, and hijacks Microsoft Edge’s DLL loading to install a malicious Rust DLL. Once active, the RAT registers the infected host with Discord and receives commands through a dedicated Discord channel, allowing attackers to steal files, capture screens, and run arbitrary commands.
Why It Matters for Trust & Control Assurance
- The campaign demonstrates how attackers can exploit legitimate development tools (Rust, Nim) and trusted platforms (Discord, Microsoft Edge) to bypass traditional defenses – a scenario continuous‑control monitoring programs are built to detect and document.
- Controlling outbound communications, enforcing application whitelisting, and maintaining auditable logs of DLL loading and privilege‑escalation attempts are essential evidence for audit readiness.
Who Is Affected – Any organization that runs Windows workstations, especially those that allow user‑initiated shortcuts or have Edge installed. Industries ranging from finance to healthcare are at risk.
Recommended Actions
- Enforce strict application control policies (allow‑list only approved executables and DLLs).
- Monitor and alert on outbound traffic to Discord or other non‑business chat services.
- Deploy endpoint detection that flags UAC bypass attempts, DLL hijacking, and unusual PowerShell activity.
- Maintain detailed logs of process creation, registry changes, and DLL loads for continuous audit evidence.
Technical Notes
- Infection chain: malicious disk image → Windows shortcut → PowerShell → Nim loader → Rust DLL (sideloader) → Discord C2.
- Uses PowerShell to modify registry and
computerdefaults.exefor a UAC bypass, then DLL search‑order hijacking into Edge’s folder. - No CVE is disclosed; the technique leverages existing Windows behaviors.