CikaBika Bot: Darktrace details a Rust RAT delivered via PDF to disk-image to LNK Word lure, Nim loader with PowerShell UAC bypass and Edge DLL hijack, then Discord C2 plus ngrok exfil
Darktrace published research on 14 October 2026 (SecurityWeek wire 15 Oct) on CikaBika Bot, a Rust-based Windows remote-access trojan that uses Discord for command-and-control. The lure chain starts with a PDF that contains a disk image holding a Windows shortcut (LNK) posing as a Word document. Opening the LNK shows a decoy document while a hidden PowerShell process decodes and runs an embedded Nim loader. That loader drops a Rust DLL and a PowerShell deployment script, then tries to move the DLL into Microsoft Edge's install directory using a UAC bypass so it can be sideloaded through DLL search-order hijacking (dbghelp.dll). Once running, CikaBika registers the host with Discord, gathers system, process and network details, takes screenshots, and accepts interactive commands over a per-victim Discord channel (execution, process control, file upload/download, camera/streaming). Darktrace also saw directory ZIP packing and exfiltration through ngrok. No CVE or patched product is involved — this is a phishing-delivered RAT. Primary: Darktrace; wire: SecurityWeek.
- Product
- Windows endpoints (phishing lure; Microsoft Edge DLL search-order hijack for persistence/load)
- Versions
- n/a — malware campaign (no vendor patch; Discord-based C2)
- Exploited in Australia?
- unknown
- Patch to
- Treat unexpected PDFs that open disk images or LNK 'Word' files as malicious. Block or alert on PowerShell spawning from Office/PDF containers, on dbghelp.dll loads from non-standard paths under Edge, and on Discord client traffic from hosts that do not run Discord. Hunt for ngrok binaries/tunnels and for the artefacts Darktrace names (tasklist_startup.txt, network_info.txt, screenshot.png). User awareness: do not open password-less disk images from email.
Primary: Darktrace — CikaBika Bot: Inside a Discord RAT (14 Oct 2026) · Vendor: Darktrace research (primary) · SecurityWeek — CikaBika Bot RAT uses Discord for C&C (15 Oct 2026)