A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers to build a distributed denial-of-service (DDoS) botnet. Researchers at QiAnXin’s XLab have tracked it since February 2026. They say the real story is not how big it is today, but how fast it is changing. RustDuck stands out because it is being rewritten from C into Rust, and its newer versions go to unusual lengths to avoid being studied or shut down.
What Happened: RustDuck Botnet Rebuilds Core in Rust for DDoS Attacks
RustDuck is a two-stage malware family that uses a small loader to decrypt and unpack a heavier core module. The core is where the interesting engineering lives, and it is the part being rewritten in Rust. Rust binaries are generally tougher for analysts to take apart than the C that has powered device malware for years. XLab says RustDuck’s Rust core shows real depth in how it derives its keys, hides from analysis, and talks to its servers.
The switch points to active development, not a quick re-skin of leaked code. The end goal is a DDoS attack: flooding a target with junk traffic from infected machines until it buckles. RustDuck is not the first botnet to reach for Rust. In April 2025, Fortinet documented RustoBot, a Rust-based botnet that spread through routers to run DDoS attacks.
Technical Details of the RustDuck Botnet
RustDuck does not lean on a single clever trick. It sprays a mix of old, well-known weaknesses and hopes one sticks. The first is the oldest in the book: devices left on the internet with weak or default passwords on their remote-login services (Telnet and SSH). Guess the password, walk in.
The second is unpatched device bugs. XLab says RustDuck goes after exposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter the internet:
- CVE-2017-17215, a remote code execution bug in Huawei HG532 routers that the original Mirai-style botnets abused back in 2017.
- CVE-2025-29635, a command-injection flaw in discontinued D-Link DIR-823X routers that Akamai watched Mirai variants exploit in March 2026. CISA added it to its Known Exploited Vulnerabilities list the next month.
- CVE-2024-1781, a command-injection bug in Totolink X6000R routers, whose maker never responded to the disclosure.
- CVE-2018-8007, a remote code execution path in Apache CouchDB that an authenticated admin can abuse.
The third path is web software. RustDuck also targets known holes in ThinkPHP, Jenkins, and Hadoop YARN, which stretches its reach from cheap home hardware to exposed server software. XLab counted more than 20 internet addresses spreading the malware, with the busiest at 176.65.139[.]204.
Anti-Analysis and Evasion Techniques
Before doing anything, RustDuck runs a checklist to decide whether it has landed in a security researcher’s lab instead of on a real victim’s device. It looks for analysis tools like Wireshark and gdb, for debuggers attached to its own process, for the fingerprints of a honeypot trap, even for virtual-machine hardware.
Each hit adds points to a risk score. Cross a threshold, and the malware erases its traces and quits before anyone can watch it run. Two of those checks stand out. One quietly tries to reach an internet address that is reserved for testing and should never answer; if something replies, RustDuck knows it is inside a fake network built to fool malware, and bails. Another compares two clocks to catch sandboxes that speed up time to rush malware into showing its hand.
Encrypted Command-and-Control Communications
RustDuck encrypts its traffic with modern ciphers: ChaCha20-Poly1305 for the handshake, AES-GCM once it is taking commands. It derives its keys with HKDF-SHA256 and a Curve25519 exchange, rotates them every ten minutes, and dresses the connection up to look like ordinary encrypted web traffic so it blends in. Once a device checks in, the operators can send a short list of orders: start an attack, stop it, report status, switch to new control servers, or quietly upgrade the malware to a newer build. The control addresses lean on free dynamic-DNS services like duckdns.org, which is where the “Duck” in the name comes from.
Business and Operational Impact
RustDuck is not the biggest botnet on the internet, but it is a signal of where the threat is heading. Rust-based malware is harder to reverse engineer, harder to detect, and harder to take down. The fact that RustDuck is actively iterating its loader variants (from LCG+XOR to ChaCha20) and its core encryption (from Ascon128 to hybrid ChaCha20-Poly1305 plus AES-GCM) shows a level of investment that should worry defenders.
- DDoS capability: The primary payload is flooding targets with junk traffic until they buckle.
- Cross-platform reach: Routers, cameras, Android boxes, and servers are all in scope.
- Supply-chain risk: Compromised servers can be used to spread the botnet further.
- Detection evasion: Rust binaries and advanced anti-analysis techniques make static and dynamic analysis significantly harder.
It also arrives in a brutal year for DDoS. The same kind of botnet, scaled up, has produced the biggest floods on record. AISURU and a cluster of related botnets, more than three million hijacked devices between them, drove attacks near 30 Tbps before a US-led operation tore down their infrastructure this spring. Next to that, RustDuck is tiny. The worry is the direction it is heading.
Mitigation and Recommendations
There is no patch for RustDuck itself, because it is malware, not a single bug. Defense means closing the doors it walks through.
Immediate Actions for Defenders
- Get remote-management interfaces off the public internet. Turn off Android Debug Bridge, Telnet, and SSH where they are not needed, and never leave them reachable with default passwords.
- Patch what you can, replace what you cannot. CouchDB has fixed releases to upgrade to, but some of these routers are past end-of-life. For the D-Link DIR-823X, CISA’s advice is to pull it from service rather than wait for a patch that is not coming, and the Totolink maker never answered the disclosure.
- Monitor for outbound connections to dynamic DNS services like duckdns.org, especially from IoT devices and servers that should not be making them.
- Segment your network so that a compromised camera or router cannot reach your production servers.
- Look for signs of the anti-analysis checks in your sandbox logs: connections to 192.0.2.1, rapid time-drift checks, and process scans for debugging tools.
Long-Term Strategic Recommendations
Organizations should treat IoT and edge devices as untrusted by default. Furthermore, they should deploy network-based detection for encrypted C2 traffic anomalies, such as frequent key rotation and unexpected TLS fingerprints. Finally, security teams should invest in Rust-aware reverse engineering capabilities, because RustDuck is unlikely to be the last botnet to make this switch.
Bottom line: RustDuck is a warning shot. Botnet authors are investing in modern languages and advanced evasion techniques, and the defenders who do not adapt will find themselves facing malware they cannot analyze, traffic they cannot decrypt, and botnets they cannot stop.
Incident Summary
| Incident Name: | RustDuck Botnet |
| Threat Actor: | Unknown operators using duckdns.org dynamic DNS infrastructure |
| Active Since: | February 2026 |
| Primary Function: | Distributed Denial-of-Service (DDoS) attacks |
| Affected Systems: | Home routers, IP cameras, Android boxes, servers (CouchDB, ThinkPHP, Jenkins, Hadoop YARN) |
| Key CVEs Abused: | CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2018-8007 |
| Core Language: | Rust (transitioning from C) |
| Encryption: | ChaCha20-Poly1305, AES-GCM, HKDF-SHA256, Curve25519 |
| Primary C2 Infrastructure: | duckdns.org dynamic DNS, busiest spreader IP 176.65.139[.]204 |
| Disclosure Date: | June 30, 2026 (The Hacker News / XLab public report) |
| Patch Status: | No single patch; defense requires hardening remote management, patching or retiring EOL devices, and network segmentation |
References
- The Hacker News, “RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS,” June 30, 2026, https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html (accessed June 30, 2026).
- QiAnxin XLab, “RustDuck: An In-Depth Analysis of a Two-Stage Botnet,” June 2026, https://blog.xlab.qianxin.com/rustduck-en/ (accessed June 30, 2026).
- Fortinet, “New Rust Botnet RustoBot Is Routed via Routers,” April 2025, https://www.fortinet.com/blog/threat-research/new-rust-botnet-rustobot-is-routed-via-routers (accessed June 30, 2026).
- CISA, “Known Exploited Vulnerabilities Catalog,” CVE-2025-29635 entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog (accessed June 30, 2026).
- Akamai, “CVE-2025-29635: Mirai Campaign Targets D-Link Devices,” March 2026, https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices (accessed June 30, 2026).
