A trusted destination is not the same as a trusted process. Darktrace’s October 14 analysis of CikaBika Bot describes a Rust-based remote access trojan that uses Discord to manage infected Windows machines. For small businesses and government contractors, the useful lesson is not simply to block a chat application: connect document execution, endpoint changes and outbound traffic into one investigation.

Source: Darktrace — CikaBika Bot: Inside a Discord RAT. Also reported by Security Affairs on October 18. The defensive recommendations below are Bulwark Black’s analysis.

What the researchers found—and what remains unproven

The analyzed package is a disk image named Proposition_Projet.img. It contains a PDF and a Windows shortcut masquerading as a Word document. Running the shortcut opens a decoy document while hidden PowerShell extracts a loader from embedded data. That loader, written in Nim, unpacks the Rust payload and a deployment script.

The script attempts to place dbghelp.dll in Microsoft Edge’s application directory, using a registry-based User Account Control bypass involving computerdefaults.exe. These details describe the attacker’s intended route, not a guaranteed outcome: Darktrace explicitly notes that the DLL’s exports are incomplete and the evidence does not prove Edge successfully loaded it. The initial distribution method is also unconfirmed; the document-themed packaging is consistent with a phishing lure, not proof of a particular email campaign.

Once executing, the RAT registers a device-specific Discord channel and collects host information. Its command interface supports remote execution and file transfers, with handlers also referencing surveillance functions. Darktrace observed an operator archive a directory and transfer it through ngrok. None of this establishes that Discord or ngrok themselves were breached; legitimate services are being repurposed as attacker infrastructure.

Why this matters to lean security teams

A domain-only allowlist can miss an important distinction: the destination may be familiar while the program contacting it is not. An unexpected DLL or script communicating with a collaboration service deserves different scrutiny from an approved desktop client. A familiar browser installation path likewise should not make a newly written DLL automatically trustworthy.

Proposal and procurement workflows are relevant exposure points for contractors because staff routinely receive outside documents. This report does not establish targeting of government contractors. It does provide a concrete reason to review how business teams handle unexpected disk images and executable shortcuts.

Defensive actions worth taking now

  • Reduce executable-document ambiguity. Show file extensions, flag shortcuts that impersonate documents and restrict unnecessary disk-image attachments at the mail or download boundary. Test rules against legitimate business workflows before broad enforcement.
  • Correlate behavior instead of alerting on PowerShell alone. Prioritize chains that connect a mounted image or shortcut, hidden or encoded PowerShell, a temporary payload and subsequent network access. Administrative scripts also use PowerShell; context determines the investigative value.
  • Watch protected application directories. Investigate unexpected writes of dbghelp.dll beneath the Edge application path. Validate provenance, hashes, signer information and process ancestry rather than treating the filename alone as malicious.
  • Review UAC-bypass indicators together. A change beneath HKCU\Software\Classes\ms-settings\shell\open\command followed by unusual computerdefaults.exe execution is a stronger lead than either event in isolation. Preserve registry and process evidence where available.
  • Make service access accountable. Identify which users and applications need Discord or ngrok. Restrict unapproved use where practical and correlate proxy, DNS and endpoint records to identify the originating process. A connection alone is not proof of compromise.

If you find a matching execution chain

Isolate the affected endpoint through established response procedures and preserve the disk image, shortcut, extracted files, process tree and network timeline. Determine which files and sessions were accessible before deleting artifacts. Review relevant identities and rotate exposed credentials from a clean device when the evidence warrants it; assess whether rebuilding the host is necessary to restore trust.

For contractors, retain the investigation’s timestamps, scope decisions and recovery evidence, and assess any contractual notification duties against confirmed facts. Do not infer data theft merely from malware presence—or conclude there was no theft because the attacker used an ordinary web service.

Bulwark Black assessment

The most reusable detection opportunity is the transition from a document workflow into script execution, application-directory tampering and unexpected service access. Pair endpoint visibility with governed outbound access. Blocking one platform may interrupt this sample’s communications, but detecting that transition is useful even when the next operator chooses a different service.