Key points
- CikaBika Bot is a Rust-written remote access trojan controlled entirely through Discord channels.
- The campaign uses a disk image containing a PDF and a disguised shortcut to deploy a Nim loader.
- Attackers bypass User Account Control to install a malicious DLL in the Microsoft Edge directory.
Darktrace researchers have documented a distribution campaign for CikaBika Bot, a remote access trojan written in the Rust programming language. According to Security Affairs, the malware relies on Discord for command and control rather than traditional infrastructure. The infection chain begins with a disk image lure that appears to be a legitimate business proposal. Once executed, the payload grants attackers the ability to run arbitrary commands, steal files, and capture screens.
By the numbers
- One primary lure file named Proposition_Projet.img serves as the initial entry point.
- Two components embedded in the Nim loader include a Rust dynamic link library and a PowerShell script.
- One specific registry modification enables the bypass of User Account Control prompts during installation.
What the figures mean
The architecture of CikaBika Bot highlights a shift toward using chat platforms for remote administration. Security Affairs notes that the final payload accepts commands through a dedicated Discord channel. The use of Rust for the core trojan and Nim for the loader suggests an attempt to evade detection by leveraging languages less common in traditional malware families. The attackers disguise the malicious Windows shortcut as a Word document while displaying a French-language PDF about writing summaries to occupy the victim.
The technical execution involves significant effort to maintain persistence and hide from security tools. The PowerShell script extracts the loader from raw data hidden within the PDF file. It then attempts to copy a malicious dynamic link library, named dbghelp.dll, into the Microsoft Edge installation folder. This technique exploits DLL search-order hijacking, replacing a legitimate debugging library with malicious code. To access the protected directory without triggering a UAC prompt, the script modifies a Windows registry setting and misuses computerdefaults.exe.
What to watch
Security teams should monitor for unusual PowerShell processes that read PDF files as raw data rather than displaying them. Analysts should look for new dynamic link libraries appearing in browser installation directories, specifically those with names matching legitimate system debugging tools. Unexplained registry changes related to user account control policies may indicate an active bypass attempt. Additionally, network traffic analysis should identify connections to Discord servers that do not match expected business applications.
Infection and persistence in general
Teams usually encounter these threats through deceptive documents that mask executable payloads. Analysts should examine disk images and shortcuts that trigger background processes while displaying benign content. Persistence often involves placing malicious libraries in trusted application folders to hijack legitimate software loading sequences. Investigating unexpected registry modifications can reveal attempts to bypass security controls. Monitoring for unknown languages in loaders helps identify evasion tactics. Checking for unauthorized chat-based command channels is essential for detecting compromised systems that use unconventional communication methods.
What to do and how to stay safe: CikaBika Bot
- Verify the integrity of files in Microsoft Edge and other browser installation directories to detect unauthorized dynamic link libraries.
- Monitor PowerShell execution logs for scripts that access PDF files as raw data sources rather than rendering them visually.
- Audit registry settings related to user account control to identify unauthorized modifications by tools like computerdefaults.exe.
- Review network traffic for unexpected connections to Discord servers or unknown tunneling services like Ngrok originating from workstations.
Step-by-step guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What programming languages are used in the CikaBika Bot campaign?
The final remote access trojan is written in Rust, while the initial loader component is written in Nim.
How does the malware bypass User Account Control?
It uses a PowerShell script to change a Windows registry setting and misuse computerdefaults.exe to avoid triggering a security prompt.
What is the name of the lure file used in the campaign?
The attackers use a disk image named Proposition_Projet.img that contains a PDF and a disguised Windows shortcut.
