iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CikaBika Bot is a Rust-based remote-access trojan (RAT) for Windows that uses Discord as its command-and-control (C2) channel. A document-themed disk image launches a decoy PDF and a malicious shortcut, then hidden PowerShell, a Nim loader and DLL search-order hijacking deliver the payload.
Darktrace documented the campaign on October 14, 2026. The observed sample can profile a host, register each victim in a dedicated Discord channel, run commands, capture screens, move files and support additional surveillance. The activity described in the report does not establish the campaign’s victim count, geographic reach or a named operator.
What CikaBika Bot is
CikaBika Bot is a Windows RAT written in Rust. Instead of relying on attacker-controlled web infrastructure built specifically for the malware, it communicates through Discord. Each compromised computer is registered to an assigned Discord channel, giving the operator a ready-made place to issue instructions and receive results.
Free tools Windows power users keep installed
One-click scans. No signup required.
“Communications platforms like Discord can provide attackers with a ready-made channel for command-and-control (C2), allowing them to manage compromised devices without establishing dedicated infrastructure.” — Darktrace, CikaBika Bot: Inside a Discord RAT, October 14, 2026
#1 Best Overall
Using a legitimate collaboration service does not make the traffic benign. The important question for defenders is which process is connecting, what it does immediately beforehand and whether the connection matches an authorized Discord client.
How the Windows infection starts
1. A document-themed disk image
The lure is an image file named Proposition_Projet.img. It contains a French-language decoy PDF and an LNK shortcut whose name is made to resemble a Microsoft Word document. Opening the shortcut displays the decoy, helping the launch appear routine while the malicious chain runs in the background.
2. Hidden PowerShell and a Nim loader
The shortcut starts PowerShell without a visible console. The script decodes an embedded executable and runs it. That executable is a Nim-based loader containing both the Rust DLL and a PowerShell deployment script.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →3. UAC bypass and Edge DLL search-order hijacking
The deployment script attempts to place a malicious dbghelp.dll in the Microsoft Edge application directory. It uses a registry-based PowerShell User Account Control (UAC) bypass and DLL search-order hijacking so that Edge loads the malicious library. The documented behavior describes a hijacking-based load path; it does not by itself prove a separate, durable boot-time persistence mechanism.
Rank #3
What CikaBika does after loading
Host reconnaissance and Discord registration
The RAT gathers basic operating-system context before waiting for instructions. Darktrace observed process enumeration with tasklist, network-configuration collection with ipconfig, screenshot capture and a public-IP lookup through ipify.com.
The malware then registers the device in Discord. Registration data includes a device identifier, hostname, registration time, private and public IP addresses, current status, uptime and the Discord channel assigned to that host. A one-channel-per-victim design can make operator workflows easy while creating a useful hunting signal for defenders.
Interactive commands
The following commands were reported in the sample’s handlers and observed activity. The exact output and permissions can depend on the operator’s implementation.
| Command | Reported function |
|---|---|
!shell |
Execute a shell command on the infected Windows host. |
!sysinfo |
Request system information. |
!info |
Return host or implant information. |
!isOn |
Check whether the device is online. |
!tasklist |
Enumerate running processes. |
!ps |
Invoke PowerShell-related activity. |
!kill |
Terminate a process. |
!upload |
Send a file from the victim to the operator. |
!download |
Request a file for delivery to the victim. |
!src |
Handler strings reference screenshots, camera access, streaming and broadcasting. |
The screenshot, camera, streaming and broadcasting functions are referenced by strings and handlers in the sample; the report does not claim that every one of those functions was exercised during the observed session.
Best Value
Archive creation and exfiltration
Darktrace observed an operator using PowerShell to compress a directory into a ZIP archive, then exfiltrating the archive through Ngrok. The operator could also request individual files through the Discord channel. This combination links archive creation, PowerShell and an outbound tunnel in a sequence that is more distinctive than any one event alone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Detection and hunting priorities
Use the behavior chain rather than a single filename or hash. The following pivots come directly from the documented activity:
Delivery and script execution
- Document-themed
.imgfiles, especially those containing a decoy PDF and an LNK that imitates a Word document. - A hidden PowerShell process launched at the same time as a document viewer or decoy-document process.
- PowerShell that decodes an embedded executable or launches an unusual Nim-built binary.
Privilege and DLL loading
- Registry changes associated with a PowerShell UAC-bypass technique.
- A newly created or modified
dbghelp.dllin the Microsoft Edge application directory. - Edge loading a library from an unexpected, user-writable or recently changed path.
Command, control and collection
- Discord network connections made by PowerShell, a loader, Edge or another process that is not an authorized Discord client.
- Per-host Discord registration patterns containing hostname, private/public IP data, uptime or a device identifier.
- Unexpected screenshot activity, process enumeration or repeated process-termination events.
- Ngrok connections shortly after PowerShell creates a ZIP archive, particularly when the archive is followed by file-transfer activity.
Correlate endpoint, registry, process, DNS and network-proxy telemetry. A Discord connection alone is not proof of CikaBika; the combination of the lure, hidden PowerShell, Edge DLL loading and channel-based control is substantially more discriminating.
What to do if the chain is found
- Isolate the Windows host from the network while preserving volatile evidence and timestamps.
- Capture the disk image, LNK, decoy document, PowerShell command lines, registry modifications and any copy of
dbghelp.dll. - Review process, PowerShell, Discord and Ngrok telemetry for other hosts showing the same sequence.
- Revoke credentials and tokens that may have been accessible from the system, then rebuild from trusted media if the DLL was loaded.
- Block or restrict unauthorized Discord and Ngrok use according to organizational policy, and add detections for the behavioral pivots above.
What is established—and what is not
The October 14, 2026 Darktrace report documents the infection method and capabilities described here. It does not publish prevalence, victim totals, geographic scope or campaign size, and it does not attribute CikaBika to a named threat actor. Those limits matter: the observed sample demonstrates capability, not how widespread the activity is.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
