RustDuck: A Stealthy, Rust-Based Botnet Targeting Routers and Servers Researchers at QiAnXin’s XLab have uncovered RustDuck, a two-stage malware family actively hijacking home routers, IP cameras, Android devices, and poorly secured servers to build a distributed denial-of-service (DDoS) botnet. First tracked in February 2026, RustDuck stands out not for its current scale but for its rapid evolution and sophisticated evasion tactics. ### Infection Vectors RustDuck spreads through multiple well-known vulnerabilities, exploiting: - Default or weak credentials on Telnet and SSH services. - Unpatched flaws in devices from TVT (DVRs/cameras), Ruijie, TP-Link, ZTE, and Android debugging interfaces. - Vulnerable web software, including ThinkPHP, Jenkins, and Hadoop YARN. Over 20 IP addresses have been identified as distribution points, with the most active 176.65.139[.]204 sharing address space with a separate ADB-targeting botnet reported earlier in 2026. ### Evasion and Stealth RustDuck’s design prioritizes evasion, employing a two-stage infection process: 1. A lightweight loader decrypts and deploys a core module, increasingly rewritten in Rust a language that complicates reverse engineering compared to traditional C-based malware. 2. The core module performs extensive anti-analysis checks, including: - Detecting debuggers (e.g., Wireshark, gdb), virtual machines, and honeypots. - Testing for reserved IP responses to identify fake networks. - Comparing system clocks to detect sandbox time acceleration. Communication is encrypted using ChaCha20-Poly1305 and AES-GCM, with keys rotated every 10 minutes. Traffic mimics legitimate HTTPS to avoid detection. Command-and-control (C2) servers leverage dynamic DNS services like duckdns.org, allowing operators to issue DDoS commands, update malware, or switch C2 addresses. ### Broader Context RustDuck follows a growing trend of Rust-based botnets, such as RustoBot (documented in April 2025), which targeted routers for DDoS attacks. While smaller than record-breaking botnets like AISURU (3M+ devices, 30 Tbps attacks), RustDuck’s advanced techniques Rust rewrites and anti-analysis measures signal a shift toward more resilient malware. The botnet’s infrastructure overlaps with other DDoS operations, suggesting possible shared hosting or coordinated activity. Though currently limited in scale, its development pace and evasion methods could inspire future threats.