A new botnet called RustDuck is grabbing home routers, IP cameras, Android boxes, and sloppy servers, then wiring them into a DDoS army. Researchers at QiAnXin’s XLab have been tracking it since February.
The name comes from its control servers using free duckdns.org addresses. But the real story isn’t the name. It’s the rewrite.
RustDuck started life in C, like most IoT malware. Its newer versions are being rebuilt in Rust. That matters. Rust binaries are harder to reverse-engineer. The encryption is modern — ChaCha20-Poly1305 for handshakes, AES-GCM for commands. Keys rotate every ten minutes. Traffic looks like normal HTTPS.
And it’s paranoid. Before executing, RustDuck runs a checklist. Looking for Wireshark. gdb. Debuggers. Honeypot signatures. Virtual machine hardware. Even checks if a reserved IP address responds (if it does, you’re in a fake network). Compares two clocks to catch sandboxes that speed up time. Cross a threshold on the risk score? It wipes its traces and bails.
The botnet spreads through brute-forcing Telnet and SSH with default passwords and exploiting old unpatched bugs. The target list includes Huawei HG532 routers (CVE-2017-17215), D-Link DIR-823X devices (CVE-2025-29635), Totolink X6000R (CVE-2024-1781), and Apache CouchDB (CVE-2018-8007). It also goes after exposed ThinkPHP, Jenkins, and Hadoop YARN instances.
XLab counted more than 20 C2 addresses. The busiest one — 176.65.139[.]204 — sits in the same address block as another ADB-targeting botnet spotted this spring. That might be a coincidence. Worth watching either way.
Defense is straightforward. Patch what you can. Replace end-of-life routers. And for the love of everything — get Telnet and SSH off the public internet.
