Darktrace uncovers CikaBika Bot RAT using Discord for C&C

Darktrace has uncovered a campaign distributing the Rust-based CikaBika Bot RAT, which receives commands via Discord. It spreads through a PDF with a disk image and a Word-lookalike LNK, bypasses UAC via the Edge directory and exfiltrates data through Ngrok.

• The RAT is written in Rust; the loader is Nim-based with a DLL and PowerShell script
• It moves the DLL into the protected Edge directory to bypass UAC
• Commands and reports go through Discord, data is exfiltrated via Ngrok
• Capabilities include reconnaissance, command execution, files, screenshots and camera