Breaches & incidents
Rust-Based CikaBika Bot Turns Discord into a Command Center
Darktrace researchers have documented a new campaign distributing a Rust-written remote access trojan called CikaBika Bot that is controlled entirely through Discord. The malware uses fake documents to infect Windows systems and abuses Discord and Ngrok to run commands, spy on victims and steal files.
According to Security Affairs, researchers at Darktrace have documented a new malware campaign distributing a remote access trojan (RAT) dubbed CikaBika Bot. The malware is written in the Rust programming language and, unusually, is controlled entirely through the Discord platform, which the operators use as a command-and-control center.
The infection chain begins with a disk image carrying fake documents designed to trick users into infecting their Windows systems. Once a machine is compromised, the trojan abuses Discord together with the Ngrok tunneling service to receive and execute commands from its operators. Security Affairs reports that the bot gives attackers the ability to spy on victims and steal files from infected machines.
The use of legitimate services such as Discord and Ngrok for command-and-control is a notable aspect of the campaign, as traffic to these platforms can blend in with normal activity and may be harder for defenders to flag or block. Writing the malware in Rust is also consistent with a broader trend among threat actors of adopting modern, cross-platform languages that can complicate analysis and detection.
Darktrace's findings, as reported by Security Affairs, describe the full infection chain from the initial disk image through to the establishment of remote control over compromised Windows hosts. Further technical details about the campaign are available in the source report.
Source: Security Affairs
