# CikaBika Bot: Rust-based RAT with Nim loader using Discord for C2 and Ngrok for exfiltration

> Darktrace documented CikaBika Bot, a Rust-based RAT delivered through a phishing disk image (.img) with an LNK masquerading as a Word document and a Nim-based loader. The RAT uses per-victim Discord channels for C2 and Ngrok tunnels for data exfiltration.

- **Published:** 2026-10-15T11:43:54Z
- **Last reviewed:** 2026-10-15T11:43:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3613
- **ID:** TL-2026-3613
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CikaBika Bot is a Windows remote access trojan written in Rust, analyzed by Tara Gould of Darktrace (published 2026-10-14) and reported by SecurityWeek on 2026-10-15. Delivery starts with a disk image named Proposition_Projet.img that contains a decoy PDF (Presentation_Generale.pdf.pdf, a French-language document about text summarization) and a malicious shortcut (Proposition_Projet_Personnalisable.docx.lnk) disguised as a Word document. When the LNK is opened, it displays the decoy and launches a hidden PowerShell process. PowerShell reads the PDF as bytes, uses a value at a fixed offset in the file as an XOR key, and decodes an embedded executable that is written to %TEMP%\IfyuUapz.txt and run through cmd /c.

The executable is a Nim-based loader holding two Base64-encoded blobs: a Rust DLL and a PowerShell deployment script. The loader attempts DLL injection and falls back to regsvr32.exe. The goal is to place the Rust DLL, named dbghelp.dll, in C:\Program Files (x86)\Microsoft\Edge\Application\, a protected directory. To get there, the script bypasses UAC by writing to HKCU\Software\Classes\ms-settings\shell\open\command and triggering computerdefaults.exe. The malicious dbghelp.dll exports a subset of the legitimate Microsoft debugging library functions, so Microsoft Edge loads it through DLL search-order hijacking of a delay-loaded dependency.

Once loaded, the Rust RAT performs reconnaissance (tasklist, ipconfig, screenshot; artifacts tasklist_startup.txt, network_info.txt, screenshot.png) and retrieves the public IP through ipify.com. It then registers the device with Discord, recording device ID, hostname, registration time, private and public IPs, status, uptime and an assigned Discord channel. Each victim gets a dedicated Discord channel used as an interactive operator interface. Observed commands: !shell, !sysinfo, !info, !isOn, !tasklist, !ps, !kill, !upload, !download, !src (screenshots), !camera, !stream and !broadcast. Observed post-compromise activity includes PowerShell compressing directories into ZIP archives and exfiltrating them through Ngrok tunnels; files can also be retrieved through Discord channels.

No attribution, CVE, or version information was published. Severity is an analyst assessment based on the surveillance and exfiltration capability. Defenders should hunt for the file-based and registry artifacts, an unexpected dbghelp.dll in the Edge Application directory, and Discord or Ngrok traffic from unexpected processes.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1548.002 Bypass User Account Control
- T1574.001 DLL
- T1036.007 Double File Extension
- T1140 Deobfuscate/Decode Files or Information
- T1027.013 Encrypted/Encoded File
- T1112 Modify Registry
- T1218.010 Regsvr32
- T1564.003 Hidden Window
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1560.001 Archive via Utility
- T1102.002 Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion

## Sources

- [CikaBika Bot: Inside a Discord RAT (Darktrace)](https://www.darktrace.com/blog/cikabika-bot-inside-a-discord-rat)
- [CikaBika Bot RAT Uses Discord for C&C (SecurityWeek)](https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/)
- [MITRE ATT&CK T1574.001 - Hijack Execution Flow: DLL](https://attack.mitre.org/techniques/T1574/001/)
- [MITRE ATT&CK T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002/)
- [MITRE ATT&CK T1102.002 - Web Service: Bidirectional Communication](https://attack.mitre.org/techniques/T1102/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3613