Threat reportMalwareTL-2026-3613
CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltration
CikaBika Bot (TL-2026-3613), also tracked as CikaBika, is a medium-severity malware campaign, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Windows (endpoints with Microsoft Edge; dbghelp.dll, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3613
- Threat ID
- TL-2026-3613
- Also known as
- CikaBika
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in CikaBika Bot
Malware and tooling: CikaBika Bot, Nim loader, RemCom, ngrok - S0508
How CikaBika Bot works
Darktrace documented CikaBika Bot, a Rust-based RAT delivered through a phishing disk image (.img) with an LNK masquerading as a Word document and a Nim-based loader. The RAT uses per-victim Discord channels for C2 and Ngrok tunnels for data exfiltration.
CikaBika Bot is a Windows remote access trojan written in Rust, analyzed by Tara Gould of Darktrace (published 2026-10-14) and reported by SecurityWeek on 2026-10-15. Delivery starts with a disk image named Proposition_Projet.img that contains a decoy PDF (Presentation_Generale.pdf.pdf, a French-language document about text summarization) and a malicious shortcut (Proposition_Projet_Personnalisable.docx.lnk) disguised as a Word document. When the LNK is opened, it displays the decoy and launches a hidden PowerShell process. PowerShell reads the PDF as bytes, uses a value at a fixed offset in the file as an XOR key, and decodes an embedded executable that is written to %TEMP%\IfyuUapz.txt and run through cmd /c.
The executable is a Nim-based loader holding two Base64-encoded blobs: a Rust DLL and a PowerShell deployment script. The loader attempts DLL injection and falls back to regsvr32.exe. The goal is to place the Rust DLL, named dbghelp.dll, in C:\Program Files (x86)\Microsoft\Edge\Application\, a protected directory. To get there, the script bypasses UAC by writing to HKCU\Software\Classes\ms-settings\shell\open\command and triggering computerdefaults.exe. The malicious dbghelp.dll exports a subset of the legitimate Microsoft debugging library functions, so Microsoft Edge loads it through DLL search-order hijacking of a delay-loaded dependency.
Once loaded, the Rust RAT performs reconnaissance (tasklist, ipconfig, screenshot; artifacts tasklist_startup.txt, network_info.txt, screenshot.png) and retrieves the public IP through ipify.com. It then registers the device with Discord, recording device ID, hostname, registration time, private and public IPs, status, uptime and an assigned Discord channel. Each victim gets a dedicated Discord channel used as an interactive operator interface. Observed commands: !shell, !sysinfo, !info, !isOn, !tasklist, !ps, !kill, !upload, !download, !src (screenshots), !camera, !stream and !broadcast. Observed post-compromise activity includes PowerShell compressing directories into ZIP archives and exfiltrating them through Ngrok tunnels; files can also be retrieved through Discord channels.
No attribution, CVE, or version information was published. Severity is an analyst assessment based on the surveillance and exfiltration capability. Defenders should hunt for the file-based and registry artifacts, an unexpected dbghelp.dll in the Edge Application directory, and Discord or Ngrok traffic from unexpected processes.
MITRE ATT&CK techniques used in TL-2026-3613
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1125 Video Capture; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Double File Extension; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.010 Regsvr32; T1564.003 Hidden Window
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1102.002 Bidirectional Communication
defense-impairment
Privilege Escalation
T1548.002 Bypass User Account Control
Initial Access
T1566.001 Spearphishing Attachment
Exfiltration
T1567 Exfiltration Over Web Service
stealth
Affected products and versions in CikaBika Bot
- Microsoft — Windows (endpoints with Microsoft Edge; dbghelp.dll search-order hijack)
Remediation for CikaBika Bot
Immediate actions
- Hunt for dbghelp.dll in C:\Program Files (x86)\Microsoft\Edge\Application\ and compare against known-good Microsoft-signed binaries
- Hunt for writes to HKCU\Software\Classes\ms-settings\shell\open\command followed by computerdefaults.exe execution
- Block or alert on Ngrok tunnel traffic and on Discord API/CDN traffic from non-browser, non-Discord processes
- Search for the file hashes and filenames listed in the IOCs
Workarounds
- Disable auto-mount of disk images via Group Policy where feasible
- Use application control to block regsvr32.exe loading DLLs from user-writable paths
Longer-term hardening
- Block or restrict mounting of ISO/IMG disk images received from email on user endpoints
- Deploy EDR with behavioral detection for hidden PowerShell, LNK-launched execution and DLL search-order hijacking
- Restrict or monitor outbound access to Discord and Ngrok where there is no business need
- Set UAC to always notify and limit local administrator rights
Timeline of CikaBika Bot
- Darktrace publishes MITRE ATT&CK mapping for the family covering execution, evasion, discovery, collection, C2 and exfiltration techniques, plus file hashes for the decoy PDF, LNK, loader and dbghelp.dll
- Darktrace describes the CikaBika Bot campaign as ongoing at publication; French-language decoy suggests targeting of French-speaking users (specific infection dates, victims and sectors not stated)
- Darktrace documents Rust RAT registration with Discord, per-victim channels, command set (!shell, !upload, !download, !src, !camera, !stream) and ZIP exfiltration via Ngrok tunnels (date is report publication)
- Darktrace documents the Nim loader, ms-settings/computerdefaults.exe UAC bypass and placement of malicious dbghelp.dll in the Edge Application directory for DLL search-order hijacking (date is report publication)
- Darktrace documents delivery via Proposition_Projet.img containing a decoy PDF and an LNK masquerading as a Word document that launches hidden PowerShell (date is report publication; infection dates not stated)
- Darktrace (Tara Gould) publishes 'CikaBika Bot: Inside a Discord RAT', the first public analysis of the family
- SecurityWeek reports on Darktrace's CikaBika Bot research
Sources cited for CikaBika Bot
- CikaBika Bot: Inside a Discord RAT (Darktrace)
- CikaBika Bot RAT Uses Discord for C&C (SecurityWeek)
- MITRE ATT&CK T1574.001 - Hijack Execution Flow: DLL
- MITRE ATT&CK T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
- MITRE ATT&CK T1102.002 - Web Service: Bidirectional Communication
Detection coverage for TL-2026-3613
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3613 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.