As reported by SecurityAffairs, Darktrace researchers have uncovered a sophisticated remote access trojan campaign dubbed CikaBika Bot that repurposes Discord as a full command-and-control channel. The campaign is notable not for any single novel technique, but for how it chains together several abuse patterns — legitimate-platform C2, less-common programming languages, DLL search-order hijacking, and UAC bypass — into a cohesive, stealthy infection pipeline targeting Windows endpoints.
Why This Campaign Deserves Attention
The CikaBika Bot campaign is a textbook example of what we at Shield53 call infrastructure blending — the deliberate use of legitimate services and signed binaries to hide malicious activity inside trusted traffic patterns. Discord's websocket-based API and widespread enterprise acceptance make it an attractive C2 channel: traffic blends with gaming, community, and even corporate collaboration use cases. Ngrok tunnels add another layer of obfuscation, making endpoint-to-infrastructure attribution extremely difficult for network-level detections alone.
What elevates this campaign beyond routine commodity malware is the multi-language execution chain. By leveraging Nim for the loader and Rust for the payload DLL, the operators are exploiting a detection gap: many endpoint protection platforms have weaker behavioral models and signature coverage for binaries compiled from these languages compared to C/C++ or .NET payloads. This is a known and growing trend — language diversification as evasion — and CikaBika demonstrates it is reaching operational maturity.
Infection Chain Breakdown
| Stage | Technique | Defender Blind Spot |
|---|---|---|
| Initial Access | Disk image lure (Proposition_Projet.img) with French-language business proposal PDF | Email/web gateway may pass .img and .dmg attachments; user awareness gap on shortcut files |
| Execution | Windows shortcut disguised as Word doc; hidden PowerShell runs while PDF displays as decoy | Shortcut (.lnk) files bypass traditional AV file-type filtering; PowerShell launched from non-standard parent |
| Loading | Nim-based loader extracts Rust DLL from data embedded in the PDF | Nim-compiled binaries often lack robust AV signatures; steganographic payload extraction evades static scanning |
| Persistence / Privilege Escalation | DLL search-order hijacking of Microsoft Edge using planted dbghelp.dll; UAC bypass via computerdefaults.exe registry manipulation | Signed application directory abuse; UAC bypass using trusted system utility |
| C2 | Discord bot API for command dispatch; Ngrok for infrastructure tunneling | Discord traffic rarely blocked; Ngrok domains rotate rapidly and are often allow-listed |
Who Is at Risk
While the current lure appears French-language and business-proposal-themed, the underlying toolchain is language-agnostic and easily repurposed. Organizations most at risk include:
The most dangerous aspect of CikaBika is not its technical sophistication — it is that every individual component uses trusted infrastructure. Discord, Ngrok, PowerShell, Edge, and computerdefaults.exe are all legitimate. Detection requires behavioral correlation, not static signatures.
Shield53 Recommendations
Immediate Actions
- Block .img and .dmg attachments at email and web gateways. Instruct users that disk image files are high-risk and should never be opened from untrusted sources.
- Restrict Discord egress traffic from corporate endpoints where the platform is not an approved business tool. If Discord must be allowed, monitor websocket connections to discord.com for anomalous bot API activity from non-gaming systems.
- Enable Microsoft Defender SmartScreen and Attack Surface Reduction rules, particularly the rule that blocks credential theft and the rule blocking execution of obfuscated scripts. Ensure ASR rule
D4F940AB-401B-4EFC-AADC-AD5F4C868D68(block process creations from Windows Defender) and the rule blocking child process creation from Office applications are enforced. - Harden UAC settings to the highest level (Always Notify) or at minimum disable silent elevation for non-administrators. Monitor for modifications to registry keys associated with
computerdefaults.exeUAC bypass, specifically underHKCU\Software\Classes\ms-settings\Shell\Open\command. - Monitor Microsoft Edge installation directories for unexpected DLL files, particularly
dbghelp.dll. Legitimate Edge installations should not have this file in the application folder. Deploy a file integrity monitoring rule on%ProgramFiles%\Microsoft\Edge\Application\directories. - Deploy detection rules for DLL side-loading using Sysmon Event ID 7 (Image Loaded) filtered for Microsoft Edge loading DLLs from its own application directory. Any DLL loaded from the Edge install path that is not Microsoft-signed warrants immediate investigation.
- Review Ngrok and tunneling service egress at the firewall/proxy layer. Ngrok subdomains (*.ngrok.io, *.ngrok.app) should be flagged or blocked unless explicitly approved for development use.
Strategic Recommendations
- Invest in behavioral EDR capable of correlating multi-stage execution chains across PowerShell, Nim-compiled binaries, and DLL side-loading patterns rather than relying on file-hash or signature-based detection alone.
- Conduct purple team exercises specifically simulating Discord-based C2 and DLL search-order hijacking against your current detection stack. Many organizations discover too late that their SIEM has no rules for legitimate-platform C2 abuse.
- Train users on shortcut (.lnk) file risks — this remains an under-addressed attack vector. Shortcuts can execute arbitrary code while displaying a familiar application icon, and most users do not understand the difference between a .lnk and a .docx.
The CikaBika campaign underscores a persistent truth: attackers do not need zero-days when living-off-the-land techniques and trusted-platform abuse continue to bypass conventional defenses. The gap between attacker tooling and defender visibility is widening in the direction of legitimate infrastructure abuse, and closing it requires behavioral detection, aggressive hardening of default Windows configurations, and a willingness to scrutinize traffic to platforms we have historically treated as benign.
