Rust-Based CikaBika Bot Uses Discord for Command and Control
Attackers leverage Discord and Ngrok to execute remote commands and steal sensitive data.
1Discord as Command Center
The CikaBika Bot campaign utilizes Discord as a command-and-control platform to manage infected Windows devices. By repurposing a legitimate communication service, attackers avoid the need for dedicated server infrastructure. This approach makes malicious traffic appear benign to standard network monitoring tools, as Discord messages are rarely blocked by default security policies.
2Deceptive Infection Chain
Infection begins with a disk image named Proposition_Projet.img containing a fake PDF and a malicious Windows shortcut. While the PDF displays a French document to distract the victim, the shortcut triggers a hidden PowerShell process. This process decrypts a Nim-based loader, which eventually deploys the Rust-based malware onto the target system.
3Nim Loader and DLL Hijacking
The malware employs a Nim loader to plant a malicious DLL, named dbghelp.dll, into the Microsoft Edge installation directory. Attackers use a PowerShell UAC bypass involving computerdefaults.exe to modify registry settings. This technique, known as DLL search-order hijacking, attempts to force the system to load the malicious library instead of the legitimate one.
4Incomplete Compatibility Risks
Researchers note that the planted DLL does not export every function required by the Edge delay-import table. Because the malicious file lacks full compatibility with the host environment, the sideloading technique may fail on certain system configurations. The observed code establishes the intended route but does not guarantee successful execution on all targets.
5Rapid Device Registration
Once the implant successfully executes, it automatically registers the compromised machine with a dedicated Discord channel. The bot immediately collects system information, including IP configuration and active task lists. Within seconds of infection, the operator gains full visibility into the host, enabling further surveillance through screen streaming and camera access capabilities.
6Ngrok for Data Exfiltration
While Discord handles command execution, the attackers utilize Ngrok to transfer stolen files. This secondary channel reduces reliance on Discord’s infrastructure and mitigates the risk of data loss if a specific account is suspended. By splitting command traffic and file exfiltration, the operators maintain a more resilient and stealthy operational framework.
7Social Engineering Tactics
The campaign relies heavily on social engineering to deliver the initial payload. By disguising a Windows shortcut as a Word document, attackers trick users into executing malicious code under the guise of a business proposal. This method highlights the persistent threat of phishing despite evolving technical defenses against automated malware distribution campaigns.
8Strategic Security Implications
CikaBika Bot demonstrates how modern malware exploits trusted platforms to bypass traditional endpoint security. By avoiding suspicious domains and dedicated servers, attackers lower the barrier to entry for complex operations. Security teams must now monitor for unusual usage of legitimate communication tools to detect potential command-and-control activity within their corporate networks.
Original article: Security Affairs — Rust-Based CikaBika Bot Uses Discord for Command and Control