Ethical Hacking News
A new, highly sophisticated malware campaign known as CikaBika Bot has been discovered, exploiting the popular communication platform Discord to turn it into a command center for its malicious operations. The bot uses fake documents to infect Windows systems, followed by the abuse of Discord and Ngrok to execute commands, spy on victims, and steal files. This campaign demonstrates the ongoing cat-and-mouse game between cyber attackers and security professionals, highlighting the importance of staying vigilant and keeping one's security up to date.
The CikaBika Bot malware campaign exploits Discord to turn it into a command center for its malicious operations. The bot uses fake documents to infect Windows systems and abuse Discord and Ngrok to execute commands and spy on victims. The campaign begins with a disk image disguised as a legitimate business proposal, which downloads a malicious program. The malicious program uses DLL search-order hijacking to bypass security checks and plants a malicious DLL in Microsoft Edge's installation folder. The bot collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through a dedicated Discord channel. The use of Discord as a command center platform is effective due to its legitimate status and widespread use. The attackers use Ngrok to transfer files, reducing their reliance on Discord and limiting the impact of a shutdown. The CikaBika Bot campaign highlights the importance of staying vigilant and keeping security up to date, even when using popular services.
The cybersecurity landscape has recently witnessed the emergence of a new, highly sophisticated malware campaign known as CikaBika Bot. This bot, developed using the Rust programming language, has been found to exploit the popular communication platform Discord to turn it into a command center for its malicious operations. The bot's modus operandi is characterized by its use of fake documents to infect Windows systems, followed by the abuse of Discord and Ngrok to execute commands, spy on victims, and steal files.
According to recent findings, the CikaBika Bot campaign begins with a disk image that resembles a legitimate business proposal, containing two files: a PDF that appears to be a French-language document about writing summaries, and a Windows shortcut disguised as a Word document. When the shortcut is opened, a hidden PowerShell process starts running in the background, while the PDF displays on screen to keep the victim occupied. This clever technique is designed to keep the victim engaged and prevent them from noticing the malicious activity taking place.
The Windows shortcut starts PowerShell, which then reads the fake PDF as raw data and uses a value hidden inside the file as a key to decrypt and extract a program, which is a loader written in Nim. This loader contains two additional components: a Rust DLL and a PowerShell script. The PowerShell script attempts to copy the DLL into Microsoft Edge's installation folder and name it "dbghelp.dll." This is done to bypass the security check by misusing the computerdefaults.exe setting, a technique known as DLL search-order hijacking.
Once the malicious DLL is planted, the attacker registers the infected machine with Discord, creating a dedicated channel for that specific device. The bot then collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through that channel. The attacker gets a full picture of the machine within the first few seconds of infection.
The command set from there covers most of what an attacker would need, including remote shell access, process listing and termination, file upload and download, and surveillance functions such as screenshot capture, camera access, and screen streaming. The use of Discord as the C2 platform allows the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure.
The CikaBika Bot campaign demonstrates how attackers continue to rely on social engineering techniques to deliver malware. The initial distribution method has not been confirmed, but it is believed that the campaign was designed for phishing, given the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF.
The use of Discord as a command center platform is particularly noteworthy, as it is a legitimate service used by millions of people and organizations every day. Traffic to Discord does not look unusual on most networks, it is not blocked by default, and standard endpoint security tools are not designed to treat Discord messages as potential command-and-control traffic. This makes it a highly effective platform for attackers to exploit, as they do not need to spin up a dedicated server, register a suspicious domain, or deal with infrastructure that can get taken down.
The attackers also use Ngrok to transfer files instead of sending large amounts of data through Discord, which reduces their reliance on Discord and limits the impact if the platform shuts down their accounts. This highlights the importance of staying vigilant and keeping one's security up to date, even when using popular and seemingly legitimate services.
The CikaBika Bot campaign is a stark reminder of the ongoing cat-and-mouse game between cyber attackers and security professionals. As attackers continue to evolve and adapt their tactics, it is essential for security experts to stay one step ahead by monitoring emerging threats and developing effective countermeasures.
In conclusion, the CikaBika Bot campaign represents a significant threat to individuals and organizations that use Discord and other communication platforms. Its use of social engineering techniques and exploitation of legitimate services makes it a highly sophisticated and effective malware campaign. As such, it is essential to remain vigilant and take necessary precautions to protect oneself from such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Rust-Based-CikaBika-Bot-Exploits-Discord-for-Command-Center-Operations-ehn.shtml
https://securityaffairs.com/201210/security/rust-based-cikabika-bot-turns-discord-into-a-command-center.html
https://www.verisq.ai/intelligence/rust-based-cikabika-bot-turns-discord-into-a-command-center-70910
Published: Sun Oct 18 08:24:09 2026 by llama3.2 3B Q4_K_M
