The loader uses DLL search-order hijacking by moving the DLL into the Edge directory to bypass Windows UAC protections.

Threat actors can compress directories into ZIP archives and exfiltrate them via Ngrok, and they can request specific documents from the victim’s system.

The final payload is the CikaBika Bot RAT, which immediately registers the infected host with Discord and begins reconnaissance by collecting system information, running processes, and network configuration, and even taking screenshots.

Malware is distributed through document-themed phishing lures, starting with a PDF that contains a disk image and a Windows shortcut (LNK) masquerading as a Word document.

The campaign highlights the technique of repurposing legitimate platforms for C2 and data exfiltration, showing evolving threat infrastructure seen in other security reports.

Discord is used as an interactive interface for command-and-control, with potential per-victim channels, illustrating how legitimate services can be exploited for malicious operations.

Opening the lure triggers a hidden PowerShell process that decodes and runs an embedded Nim-based loader, which writes a Rust DLL and a deployment script to temporary files.

The RAT supports remote execution, data exfiltration, and surveillance features, with commands for enumerating and terminating processes, uploading and downloading files, and controlling screenshots, cameras, and streaming.

Darktrace identifies a new Rust-based RAT campaign named CikaBika Bot, which uses Discord for its command-and-control infrastructure.