A fresh remote access trojan has been assembled by attackers using a chat platform that most workplaces already permit. Darktrace discovered the operation and gave the malware the name CikaBika Bot.
Phishing-style lures set the infection in motion. A disk image rides along inside a PDF, and tucked within the image sits a shortcut file masquerading as a Word document. A victim who opens it sees a decoy document, while behind the scenes a concealed PowerShell process decodes and runs an embedded executable.
That embedded executable turns out to be a loader written in Nim, packaged with a PowerShell deployment script and a Rust DLL. Placement of the DLL into Edge’s protected directory is the script’s next gambit — a bid to slip past User Account Control in Windows. Darktrace’s assessment is that code is being sideloaded by way of DLL search-order hijacking, with functions exported from a Microsoft debugging library.
Registration with Discord comes immediately once the RAT reaches a machine, followed by a sweep for network configuration, system details, running processes and a screenshot.
Discord doubles as an interactive console through which commands and results pass. An operator can execute commands, list and terminate processes, transfer files, and seize the camera for screenshots or live streaming. Directories can also be compressed into ZIP archives and sent out over Ngrok.
Blocking the domain is not an option, since the traffic looks like a legitimate service. Defenders have to focus on the telltale sequence — PDF, disk image, hidden PowerShell — that comes before the callout.
