---
title: Hunt: CikaBika Rust RAT, a rogue dbghelp.dll in the Edge folder and Discord C2 | ctxsec
url: https://ctxsec.com/items/hunt-cikabika-discord-rat
description: ""
status: "hunt idea (from Darktrace IoCs)"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cikabika-discord-rat.md)

hunt idea (from Darktrace IoCs)

2026-10-14

### Hunt: CikaBika Rust RAT, a rogue dbghelp.dll in the Edge folder and Discord C2

Darktrace (Oct 14) describes a campaign using a disk image (`Proposition_Projet.img`) with a decoy French PDF and an LNK posing as a .docx. Hidden PowerShell XOR-decodes a Nim loader into `%TEMP%\IfyuUapz.txt`, which plants a Rust DLL as `C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll` via a `computerdefaults.exe` UAC bypass. Hunt for: writes to `HKCU\Software\Classes\ms-settings\shell\open\command`; `C:\Windows\Temp\dbghelp.tmp`; any non-Microsoft-signed dbghelp.dll in the Edge directory; LNK files spawning hidden PowerShell that reads a PDF as bytes; non-browser processes talking to Discord API/gateway, ipify.org lookups, and ngrok tunnels. MD5s: LNK 62e3e85eca78a0cd7e6669e9f33d936d, dbghelp.dll c66858718d883bcfb9ce2c19b59f96c9, loader 2deb724a709b0b892248405323350e9b, PDF eeb52cb95113a131c2c7713c17872da6.

Sources: [Darktrace: CikaBika Bot](https://www.darktrace.com/blog/cikabika-bot-inside-a-discord-rat)