November 7, 2022

[Part 1] Analysis of a Raccoon Stealer v1 Infection

Darktrace’s SOC team observed a fast-paced compromise involving Raccoon Stealer v1. See which steps the Raccoon Stealer v1 took to extract company data!

Written by

Mark Turner

SOC Shift Supervisor

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Mark Turner

SOC Shift Supervisor

Written by

Sam Lister

Specialist Security Researcher

Nov 2022

Introduction

Towards the end of March 2022, the operators of Raccoon Stealer announced the closure of the Raccoon Stealer project [1]. In May 2022, Raccoon Stealer v2 was unleashed onto the world, with huge numbers of cases being detected across Darktrace’s client base. In this series of blog posts, we will follow the development of Raccoon Stealer between March and September 2022. We will first shed light on how Raccoon Stealer functioned before its demise, by providing details of a Raccoon Stealer v1 infection which Darktrace’s SOC saw within a client network on the 18^th March 2022. In the follow-up post, we will provide details about the surge in Raccoon Stealer v2 cases that Darktrace’s SOC has observed since May 2022.

What is Raccoon Stealer?

The misuse of stolen account credentials is a primary method used by threat actors to gain initial access to target environments [2]. Threat actors have several means available to them for obtaining account credentials. They may, for example, distribute phishing emails which trick their recipients into divulging account credentials. Alternatively, however, they may install information-stealing malware (i.e, info-stealers) onto users’ devices. The results of credential theft can be devastating. Threat actors may use the credentials to gain access to an organization’s SaaS environment, or they may use them to drain users’ online bank accounts or cryptocurrency wallets.

Raccoon Stealer is a Malware-as-a-Service (MaaS) info-stealer first publicized in April 2019 on Russian-speaking hacking forums.

Figure 1: One of the first known mentions of Raccoon Stealer on a Russian-speaking hacking forum named ‘Hack Forums’ on the 13th April 2019

The team of individuals behind Raccoon Stealer provide a variety of services to their customers (known as ‘affiliates’), including access to the info-stealer, an easy-to-use automated backend panel, hosting infrastructure, and 24/7 customer support [3].

Once Raccoon Stealer affiliates gain access to the info-stealer, it is up to them to decide how to distribute it. Since 2019, affiliates have been observed distributing the info-stealer via a variety of methods, such as exploit kits, phishing emails, and fake cracked software websites [3]/[4]. Once affiliates succeed in installing Raccoon Stealer onto target systems, the info-stealer will typically seek to obtain sensitive information saved in browsers and cryptocurrency wallets. The info-stealer will then exfiltrate the stolen data to a Command and Control (C2) server. The affiliate can then use the stolen data to conduct harmful follow-up activities.

Towards the end of March 2022, the team behind Raccoon Stealer publicly announced that they would be suspending their operations after one of their core developers was killed during the Russia-Ukraine conflict [5].

Figure 2: Raccoon Stealer resignation post on March 25th 2022

Recent details shared by the US Department of Justice [6]/[7] indicate that it was in fact the arrest, rather than the death, of a key Raccoon Stealer operator which led the Raccoon Stealer team to suspend their operations [8].

The closure of the Raccoon Stealer project, which ultimately resulted from the FBI-backed dismantling of Raccoon Stealer’s infrastructure in March 2022, did not last long, with the completion of Raccoon Stealer v2 being announced on the Raccoon Stealer Telegram channel on the 17^th May 2022 [9].

Figure 3: Telegram post about new version of Raccoon Stealer

In the second part of this blog series, we will provide details of the recent surge in Raccoon Stealer v2 activity. In this post, however, we will provide insight into how the old version of Raccoon Stealer functioned just before its demise, by providing details of a Raccoon Stealer v1 infection which occurred on the 18^th March 2022.

Attack Details

On the 18^th March, at around 13:00 (UTC), a user’s device within a customer’s network was seen contacting several websites providing fake cracked software.

Figure 4: The above figure — obtained from the Darktrace Event Log for the infected device — highlights its connections to cracked software websites such as ‘licensekeysfree[.]com’ and ‘hdlicense[.]com’ before contacting ‘lion-files[.]xyz’ and ‘www.mediafire[.]com’

The user’s attempt to download cracked software from one of these websites resulted in their device making an HTTP GET request with a URI string containing ‘autodesk-revit-crack-v2022-serial-number-2022’ to an external host named ‘lion-filez[.]xyz’

Figure 5: Screenshot from hdlicense[.]com around the time of the infection shows a “Download” button linking to the ‘lion-filez[.]xyz’ endpoint

The device’s HTTP GET request to lion-filez[.]xyz was immediately followed by an HTTPS connection to the file hosting service, www.mediafire[.]com. Given that threat actors are known to abuse platforms such as MediaFire and Discord CDN to host their malicious payloads, it is likely that the user’s device downloaded the Raccoon Stealer v1 sample over its HTTPS connection to www.mediafire[.]com.

After installing the info-stealer sample, the user’s device was seen making an HTTP GET request with the URI string ‘/g_shock_casio_easy’ to 194.180.191[.]185. The endpoint responded to the request with data related to a Telegram channel named ‘G-Shock’.

Figure 6: Telegram channel ‘@g_shock_casio_easy’

The returned data included the Telegram channel’s description, which in this case, was a base64 encoded and RC4 encrypted string of characters [10]/[11]. The Raccoon Stealer sample decoded and decrypted this string of characters to obtain its C2 IP address, 188.166.49[.]196. This technique used by Raccoon Stealer v1 closely mirrors the espionage method known as ‘dead drop’ — a method in which an individual leaves a physical object such as papers, cash, or weapons in an agreed hiding spot so that the intended recipient can retrieve the object later on without having to come in to contact with the source. In this case, the operators of Raccoon Stealer ‘left’ the malware’s C2 IP address within the description of a Telegram channel. Usage of this method allowed the operators of Raccoon Stealer to easily change the malware’s C2 infrastructure.

After obtaining the C2 IP address from the ‘G-Shock’ Telegram channel, the Raccoon Stealer sample made an HTTP POST request with the URI string ‘/’ to the C2 IP address, 188.166.49[.]196. This POST request contained a Windows GUID, a username, and a configuration ID. These details were RC4 encrypted and base64 encoded [12]. The C2 server responded to this HTTP POST request with JSON-formatted configuration information [13], including an identifier string, URL paths for additional files, along with several other fields. This configuration information was also concealed using RC4 encryption and base64 encoding.

Figure 7- Fields within the JSON-formatted configuration data [13]

In this case, the server’s response included the identifier string ‘hv4inX8BFBZhxYvKFq3x’, along with the following URL paths:

/l/f/hv4inX8BFBZhxYvKFq3x/77d765d8831b4a7d8b5e56950ceb96b7c7b0ed70
/l/f/hv4inX8BFBZhxYvKFq3x/0cb4ab70083cf5985b2bac837ca4eacb22e9b711
/l/f/hv4inX8BFBZhxYvKFq3x/5e2a950c07979c670b1553b59b3a25c9c2bb899b
/l/f/hv4inX8BFBZhxYvKFq3x/2524214eeea6452eaad6ea1135ed69e98bf72979

After retrieving configuration data, the user’s device was seen making HTTP GET requests with the above URI strings to the C2 server. The C2 server responded to these requests with legitimate library files such as sqlite3.dll. Raccoon Stealer uses these libraries to extract data from targeted applications.

Once the Raccoon Stealer sample had collected relevant data, it made an HTTP POST request with the URI string ‘/’ to the C2 server. This posted data likely included a ZIP file (named with the identifier string) containing stolen credentials [13].

The observed infection chain, which lasted around 20 minutes, consisted of the following steps:

1. User’s device installs Raccoon Stealer v1 samples from the user attempting to download cracked software

2. User’s device obtains the info-stealer’s C2 IP address from the description text of a Telegram channel

3. User’s device makes an HTTP POST request with the URI string ‘/’ to the C2 server. The request contains a Windows GUID, a username, and a configuration ID. The response to the request contains configuration details, including an identifier string and URL paths for additional files

4. User’s device downloads library files from the C2 server

5. User’s device makes an HTTP POST request with the URI string ‘/’ to the C2 server. The request contains stolen data

Darktrace Coverage

Although RESPOND/Network was not enabled on the customer’s deployment, DETECT picked up on several of the info-stealer’s activities. In particular, the device’s downloads of library files from the C2 server caused the following DETECT/Network models to breach:

Anomalous File / Masqueraded File Transfer
Anomalous File / EXE from Rare External Location
Anomalous File / Zip or Gzip from Rare External Location
Anomalous File / EXE from Rare External Location
Anomalous File / Multiple EXE from Rare External Locations

Figure 8: Event Log for the infected device shows 'Anomalous File / Masqueraded File Transfer' model breach after the device's download of a library file from the C2 server

Since the customer was subscribed to the Darktrace Proactive Threat Notification (PTN) service, they were proactively notified of the info-stealer’s activities. The quick response by Darktrace’s 24/7 SOC team helped the customer to contain the infection and to prevent further damage from being caused. Having been alerted to the info-stealer activity by the SOC team, the customer would also have been able to change the passwords for the accounts whose credentials were exfiltrated.

If RESPOND/Network had been enabled on the customer’s deployment, then it would have blocked the device’s connections to the C2 server, which would have likely prevented any stolen data from being exfiltrated.

Conclusion

Towards the end of March 2022, the team behind Raccoon Stealer announced that they would be suspending their operations. Recent developments suggest that the arrest of a core Raccoon Stealer developer was responsible for this suspension. Just before the Raccoon Stealer team were forced to shut down, Darktrace’s SOC team observed a Raccoon Stealer infection within a client’s network. In this post, we have provided details of the network-based behaviors displayed by the observed Raccoon Stealer sample. Since these v1 samples are no longer active, the details provided here are only intended to provide historical insight into the development of Raccoon Stealer’s operations and the activities carried out by Raccoon Stealer v1 just before its demise. In the next post of this series, we will discuss and provide details of Raccoon Stealer v2 — the new and highly prolific version of Raccoon Stealer.

Thanks to Stefan Rowe and the Threat Research Team for their contributions to this blog.

References

[1] https://twitter.com/3xp0rtblog/status/1507312171914461188

[2] https://www.gartner.com/doc/reprints?id=1-29OTFFPI&ct=220411&st=sb

[3] https://www.cybereason.com/blog/research/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block

[4] https://www.cyberark.com/resources/threat-research-blog/raccoon-the-story-of-a-typical-infostealer

[5] https://www.bleepingcomputer.com/news/security/raccoon-stealer-malware-suspends-operations-due-to-war-in-ukraine/

[6] https://www.justice.gov/usao-wdtx/pr/newly-unsealed-indictment-charges-ukrainian-national-international-cybercrime-operation

[7] https://www.youtube.com/watch?v=Fsz6acw-ZJY

[8] https://riskybiznews.substack.com/p/raccoon-stealer-dev-didnt-die-in

[9] https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d

[10] https://blog.cyble.com/2021/10/21/raccoon-stealer-under-the-lens-a-deep-dive-analysis/

[11] https://decoded.avast.io/vladimirmartyanov/raccoon-stealer-trash-panda-abuses-telegram/

[12] https://blogs.blackberry.com/en/2021/09/threat-thursday-raccoon-infostealer

[13] https://cyberint.com/blog/research/raccoon-stealer/

Appendices

Specialist Security Researcher

Inside the SOC

Written by

Mark Turner

SOC Shift Supervisor

Written by

Sam Lister

Specialist Security Researcher

Malware Research Lead

Senior Product Executive

Watch the NIS2 Webinar

Blog

Network

October 20, 2026

Why Kubernetes Security Needs A Behavioral Approach

Kubernetes has become a foundational technology for modern cloud-native infrastructure. It can orchestrate everything from customer-facing applications to data pipelines and, increasingly, AI workloads. This is due to the highly scalable nature of Kubernetes, making it cost efficient and reliable.

Gartner projects that by 2028, 95% of new AI deployments will run on Kubernetes, up from less than 30% today¹. However, the same qualities that make Kubernetes powerful also make it uniquely challenging to secure, leaving many organizations with limited visibility into their clusters. This lack of visibility increases risk - it’s difficult to secure what you can’t see.

However, this risk is often looked at as purely a posture management challenge. While Cloud Security Posture Management (CSPM) solutions can tell you how a cluster should be configured, they don’t tell you what it is doing in real time. This requires runtime behavioral monitoring of clusters to detect active threats.

Yet existing approaches to securing Kubernetes by most Cloud Detection and Response (CDR) and Network Detection and Response (NDR) vendors often have limited coverage or require a third-party integration to forward traffic and metadata. This means that capabilities can be limited and detections can lack the context of the wider environment, which slows down triage, investigation and response.

Why Kubernetes is hard to secure

Traditional security tooling was built for persistent, long-term infrastructure such as servers and virtual machines with fixed identities that last months or years. Some elements of Kubernetes environments can have a much shorter lifespan, breaking many assumptions those tools rely on:

Increased complexity
1. Kubernetes environments can be complex in comparison to traditional infrastructure, with many different elements to consider such as nodes, clusters, containers, pods and the workloads themselves.
Ephemeral by design
1. Kubernetes pods can spin up and terminate in seconds. A container that was compromised may no longer exist by the time a deeper investigation is required, leaving no artifact to analyze. This poses a unique challenge for security operations.
Weaker workload boundaries
1. Kubernetes containers use lightweight, shared-kernel isolation rather than separate virtual machines, improving efficiency but reducing separation between workloads and the host. As a result, a compromised container may have a greater potential impact on the node and neighboring workloads than a compromised virtual machine (VM).²
2. Recent vulnerabilities have shown that threat actors can escape a container and gain access to the underlying host.^{3, 4}
Everything is API-driven
1. Dozens or hundreds of microservices communicate over internal APIs, and the Kubernetes control plane itself is an API. This creates a large and dynamic attack surface, making it difficult to distinguish legitimate activity from malicious behavior.
2. Without identity-aware runtime visibility, threat actors can move laterally between pods and exploit misconfigured role-based access controls (RBAC) with little chance of detection.

Rising to the challenge of securing Kubernetes

With the release of Darktrace 7.2, Darktrace / HYBRID NETWORK can extend behavioral security into Kubernetes, delivering visibility, detection and response capabilities across runtime activity. Darktrace addresses the challenges of securing Kubernetes environments in several ways.

Behavioral detection, not static rules

Many Kubernetes runtime tools rely on predefined rules and signatures - a fixed list of “bad” behaviors to match against. That approach struggles with novel attacks and generates noise at scale. Darktrace takes a different approach: our Adaptive AI builds a Unique Behavioral Profile for each organization from the ground up, learning the normal behavior of every workload, node and identity in your cluster. It then uses this understanding to detect meaningful deviations from expected behavior, which serves as the basis for surfacing suspicious and malicious activity.

A pod reaching out to an unfamiliar destination, an unexpected executable launching inside a workload, or an identity performing an action it has never performed, all surface as anomalies without anyone having to write a rule in advance.

Darktrace surfaces unexpected Kubernetes activity that does not align with an organization’s Unique Behavioral Profile

‍

Visibility across the network, the process, and the control plane

Darktrace monitors Kubernetes at three levels that together provide comprehensive runtime visibility:

Network-layer
1. Traffic between pods, across nodes and out to the internet. This helps to detect lateral movement and unusual connectivity, whether internal or external.
Process-layer
1. What is executing inside your containers. If a process reads a sensitive credential file or spawns an unexpected shell inside a production pod, Darktrace can identify that activity and use it as context for further detections.
Control plane
1. Activity against the Kubernetes API itself: someone executes a command in a running pod, RBAC changes, or unusual administrative actions. Many high-impact security events involve the control plane, an area that is often less visible to solutions that only analyze or scan network-layer telemetry.

Misconfiguration and vulnerability awareness

Runtime detection is strongest when combined with posture and exposure management. Darktrace surfaces risky pod configurations, such as privileged containers, host networking, and over-permissive service accounts as workloads are deployed, and links CVEs from images to the workloads running them. Security teams can go beyond simply knowing that a vulnerability exists and see exactly where it is in the cluster. When combined with behavior-based detections, this provides invaluable context that can help prioritize incidents and proactively identify areas that need further attention. For example, anomalous workload behavior on its own might not be very interesting to a security team at first, but if that same workload is known to host sensitive data, is known to have critical vulnerabilities associated with it, or is publicly accessible, then this narrative becomes much more suspicious and demanding of their attention.

Darktrace highlights Kubernetes misconfigurations such as privileged containers, host networking, and missing security controls, helping teams prioritize runtime alerts with valuable exposure and risk context

‍

Response, tailored to Kubernetes

Detection is most effective when paired with response. Darktrace can take precise actions on Kubernetes workloads, including blocking a malicious connection at the pod level, helping to safely contain threats while security teams investigate. Response actions can be taken fully autonomously or via a human-in-the-loop process, which is completely configurable depending on the desired level of autonomy and scope. Darktrace is expanding the number of Kubernetes-native response actions to give customers even more flexibility when containing threats.

Forensics that survive the workload

Because containers are so short-lived, evidence disappears fast and this can make it very difficult to answer questions related to the initial detections. Darktrace solves this with Forensic Acquisition & Investigation capabilities that extend to Kubernetes containers, allowing investigations to be triggered manually by an analyst, or automatically from an alert, preserving evidence before the workload is gone.

For incident responders, this addresses a key challenge in container security: being able to answer “what actually happened?” after an ephemeral workload has vanished.

One platform, not another silo

Kubernetes doesn't exist in isolation, and neither should its security. Darktrace correlates cluster activity with the surrounding cloud environment, including AWS, Azure and GCP identities, network activity and cloud assets, allowing analysts to pivot between a Kubernetes workload and its wider context. A single anomalous action can be traced from the control plane to the pod, and from the pod to the cloud identity behind it, all within a single investigation workflow. This can also include alerts from other areas of hybrid infrastructure or third-party sources where relevant, adding more context to investigations and speeding up workflows for human analysts.

Built to deploy easily

Operational complexity can be a barrier to security adoption. Darktrace / HYBRID NETWORK for Kubernetes installs with a single command, and for teams that manage their infrastructure as code, it supports raw manifests so the deployment can live in a Git repository and be managed through existing GitOps workflows. The same deployment approach works across Kubernetes environments in AWS, Azure, Google Cloud, and on-premises infrastructure. Early adopters of Darktrace’s Kubernetes capabilities have highlighted the simplicity of deployment and time to value.

Darktrace can deploy across your Kubernetes environment and wider hybrid infrastructure, while also providing visibility into Kubernetes deployment structure and status

Next steps

Kubernetes environments are dynamic, ephemeral and API-driven in ways that challenge traditional security tooling. With Kubernetes usage increasing due to widespread AI adoption, it is essential to secure Kubernetes environments as part of securing what AI can do. Darktrace / HYBRID NETWORK addresses these challenges by learning normal behavior in Kubernetes environments across network, process and control-plane layers, identifying meaningful threats and enabling targeted response. Combined with the context of wider hybrid infrastructure and forensic investigation capabilities, Darktrace provides visibility into both emerging threats and active incidents.

To see how Darktrace can help secure your Kubernetes environment and your wider hybrid infrastructure, get in touch to arrange your free trial. Existing customers can contact their Darktrace Account Team for more information about deployment options and licensing.

‍

Sources

[1] Gartner, Container Management research, 2025: "By 2028, 95% of new AI deployments will use Kubernetes, up from less than 30% today." https://www.gartner.com/en/documents/7913109. (quote reproduced under Gartner reprint at https://www.kubermatic.com/magic-quadrant-and-critical-capabilities-for-container-management/)

[2] Palo Alto Networks (Unit 42) – Container Breakouts: Escape Techniques in Cloud Environments. https://unit42.paloaltonetworks.com/container-escape-techniques/

[3] runC container-escape vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881), disclosed by a SUSE researcher on November 5, 2025. https://www.securityweek.com/runc-vulnerabilities-can-be-exploited-to-escape-containers/

[4] NVIDIAScape (CVE-2025-23266), CVSS 9.0. https://nvidia.custhelp.com/app/answers/detail/a_id/5659

[related-resource]

‍

About the author

Elise Longhurst

Senior Product Executive

Blog

Network

October 15, 2026

CikaBika Bot: Inside a Discord RAT

‍

Key Takeaways

· Darktrace malware researchers have found an ongoing malware campaign using a document-themed lure containing a malicious LNK file and a PDF with an embedded payload.

· The Nim based loader deploys a Rust-based remote access trojan (RAT), using a UAC bypass and DLL search-order hijacking technique targeting Microsoft Edge.

· The RAT uses Discord for C2, creating dedicated channels to manage infected devices and execute commands.

· CikaBika Bot supports system reconnaissance, remote command execution, screenshot capture, and file transfers.

‍

Introduction

In a threat landscape where attackers continue to rely on social engineering techniques to deliver malware, legitimate services are increasingly being abused to support malicious operations. Communications platforms like Discord can provide attackers with a ready-made channel for command-and-control (C2), allowing them to manage compromised devices without establishing dedicated infrastructure.

Malware researchers at Darktrace have identified a campaign distributing CikaBika, a Rust-based RAT that uses Discord for C2. The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s installation directory using a PowerShell UAC bypass. Once running, the RAT collects host information, registers the device with Discord, and accepts commands through a dedicated channel.

Technical Analysis

‍

Figure 1: Contents of Proposition_Projet.img.

‍

Initial access and PDF payload

The malware is packaged within a disk image named Proposition_Projet.img. Inside are a PDF titled “Presentation_Generale.pdf.pdf” and a Windows shortcut (LNK) disguised as a Word document, “Proposition_Projet_Personnalisable.docx”. The delivery method has not been confirmed; however, the filenames and document-themed lure are consistent with a phishing campaign.

‍

Figure 2: PowerShell command embedded in the malicious shortcut.

Opening the shortcut launches a hidden PowerShell process while displaying the PDF as a decoy. The French-language document explains how to produce a written summary or contraction of a text. In the background, PowerShell reads the PDF as bytes and uses the value at offset 239 (0x20) as an XOR key to decode an embedded executable. The resulting payload is written to %TEMP%\IfyuUapz.txt and executed using cmd /c.

Nim loader and UAC bypass

“IfyuUapz.txt” is a Nim-based loader that contains two Base64-encoded blobs: a Rust dynamic-link library (DLL) and a PowerShell deployment script. Both are decoded and written to temporary files, referenced to within the loader as “dllFile” and “copyPs1”. The loader runs the script through a hidden PowerShell process using an encoded command, then attempts to load the DLL using Nim’s loadLib function. If loading fails, it invokes regsvr32.exe and retries.

The PowerShell component is responsible for moving the DLL to C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll. It first copies the DLL to C:\Windows\Temp\dbghelp.tmp, then modifies HKCU\Software\Classes\ms-settings\shell\open\command so that launching computerdefaults.exe can trigger a command to move the staged DLL into the protected Edge directory. This is an attempt to bypass User Account Control (UAC), which depends on the target’s Windows configuration.

The script also compiles a small C# helper that calls ShowWindow to hide windows associated with Windows Settings and ApplicationFrameHost. It launches the bypass helper three times, checks for the presence of the destination DLL, and attempts to delete the temporary scripts, intermediate DLL, and associated registry changes.

‍

Figure 4: Legitimate *msedge.exe* function to load the legitimate *dbghelp.dll*.

‍

The legitimate msedge.exe has a delay-loaded dependency on dbghelp.dll, and the malicious DLL exports a subset of the functions associated with Microsoft’s debugging library. The attacker appears to be exploiting this dependency through DLL search-order hijacking. However, it does not export every function in Edge’s delay-import table, meaning its compatibility with the host is incomplete. The observed code establishes the intended sideloading route, rather than proving that Edge successfully loaded the planted DLL.

‍

Rust RAT payload

Figure 5: Discord configuration within the RAT.

The malicious dbghelp.dll (IfyuUapz.txt) is a Rust-based RAT. At startup, the RAT registers the compromised device with Discord and begins collecting information about the host. Its reconnaissance routine gathers system details, runs tasklist to enumerate processes, executes ipconfig to obtain network configuration, and attempts to take a screenshot. The resulting artifacts include tasklist_startup.txt, network_info.txt, and screenshot.png.

Figure 6: Network configuration notification in Discord channel.

‍

Figure 7: Network configuration output from *network_info.txt*.

‍

Discord C2

The RAT uses Discord channels to send commands and report results. The operator can send commands to the device’s channel and receive the resulting output in the same conversation. This gives the attacker an interactive command interface without having to operate and maintain a dedicated C2 server.

Figure 8: Commands available in Discord.

The command set includes !shell for remote command execution; !sysinfo and !info for host details; !isOn for status checks; !tasklist and !ps for process enumeration; and !kill for process termination. File-transfer commands include !upload and !download. Additional strings and command handlers reference screenshots (!src), camera access (!camera), streaming (!stream), and broadcasting (!broadcast).

‍

Figure 9: Device registration in Discord.

During device registration, the malware retrieves the victim’s public IP address using ipify.com. The registration message records the device ID, hostname, registration time, private and public IP addresses, status, uptime, and the Discord channel assigned to that device.

Operator activity and exfiltration

Figure 10: Powershell commands sent through Discord to exfiltrate data.

Once a device is registered, the attacker can issue commands through its dedicated Discord channel. In the observed activity, the attacker compressed a directory into a ZIP and exfiltrated it using ngrok.

Figure 11: Download command to retrieve a document from the target.

‍

The operator can also use !download to retrieve files from target. The example above displays a request for a specific document on the victim’s desktop. The requested file is then returned through the device’s Discord channel, giving the attacker a direct way to store and access selected data.

Conclusion

CikaBika Bot demonstrates how attackers continue to rely on social engineering techniques to deliver malware. Although the initial distribution method has not been confirmed, the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF, suggests the campaign was designed for phishing.

While Nim is less commonly encountered than C in Windows malware, it has increasingly appeared in malicious tooling. In this case, Nim is used to unpack and deploy a Rust-based RAT, adding another layer to the infection chain.

Once installed, CikaBika Bot uses Discord as its C2 platform, allowing the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure. The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.

Credit to Tara Gould (Malware Research Lead)

Indicators of Compromise (IoCs)

Presentation_Generale.pdf.pdf - eeb52cb95113a131c2c7713c17872da6

Proposition_Projet_Personnalisable.docx.lnk - 62e3e85eca78a0cd7e6669e9f33d936d

dbghelp.dll - c66858718d883bcfb9ce2c19b59f96c9

IfyuUapz.txt - 2deb724a709b0b892248405323350e9b

MITRE ATTACK

T1204.002 – User Execution: Malicious File
T1036.007 – Masquerading: Double File Extension
T1059.001 – PowerShell
T1027 – Obfuscated Files or Information
T1140 – Deobfuscate/Decode Files or Information
T1548.002 – Bypass User Account Control
T1112 – Modify Registry
T1574.001 – DLL Search Order Hijacking
T1036.005 – Masquerading: Match Legitimate Resource Name or Location
T1082 – System Information Discovery
T1016 – System Network Configuration Discovery
T1057 – Process Discovery
T1113 – Screen Capture
T1059.003 – Command and Scripting Interpreter: Windows Command Shell
T1102.002 – Web Service: Bidirectional Communication
T1560.001 – Archive Collected Data: Archive via Utility
T1567 – Exfiltration Over Web Service
T1070.004 – Indicator Removal: File Deletion
T1218.010 – Regsvr32
T1005 – Data from Local System
T1074.001 – Data Staged: Local Data Staging
T1041 – Exfiltration Over C2 Channel
T1564.003 – Hide Artifacts: Hidden Window
T1027.013 – Encrypted/Encoded File

About the author

Tara Gould

Malware Research Lead

あなたのデータ × DarktraceのAI

唯一無二のDarktrace AIで、ネットワークセキュリティを次の次元へ

デモを予約

Check out this article by Darktrace: [Part 1] Analysis of a Raccoon Stealer v1 Infection

[Part 1] Analysis of a Raccoon Stealer v1 Infection

Introduction

What is Raccoon Stealer?

Attack Details

Darktrace Coverage

Conclusion

References

Appendices

CikaBika Bot: Inside a Discord RAT

Why Kubernetes Security Needs A Behavioral Approach

ブログをお楽しみ頂けましたか？

More in this series

Why Kubernetes Security Needs A Behavioral Approach

CikaBika Bot: Inside a Discord RAT

A Chain Reaction: Blockchain-Hosted Infostealer Campaign Targets Windows and macOS

Blog

Network

October 20, 2026

Why Kubernetes Security Needs A Behavioral Approach

Why Kubernetes is hard to secure

Rising to the challenge of securing Kubernetes

Behavioral detection, not static rules

Visibility across the network, the process, and the control plane

Misconfiguration and vulnerability awareness

Response, tailored to Kubernetes

Forensics that survive the workload

One platform, not another silo

Built to deploy easily

Next steps

Blog

Network

October 15, 2026

CikaBika Bot: Inside a Discord RAT

Introduction

Technical Analysis

Initial access and PDF payload

Nim loader and UAC bypass

Rust RAT payload

Discord C2

Operator activity and exfiltration

Conclusion

Indicators of Compromise (IoCs)

MITRE ATTACK