RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

RustDuck is a two-stage malware botnet first tracked by QiAnXin XLab in February 2026. It targets home routers, IP cameras, Android boxes, and poorly secured servers, recruiting them into a DDoS botnet. Stage 1 is a small loader that decrypts and unpacks a heavier core module (Stage 2). The core module is actively being rewritten from C to Rust, making reverse engineering more difficult. Infection vectors include: brute-forcing weak/default credentials on Telnet and SSH; exploiting unpatched vulnerabilities in devices from TVT, Ruijie, TP-Link, ZTE, Huawei, D-Link, and Totolink; targeting exposed Android Debug Bridge (ADB) interfaces; and exploiting vulnerabilities in web software including ThinkPHP, Jenkins, and Hadoop YARN. The malware employs extensive anti-analysis checks before executing, including: detecting analysis tools (Wireshark, gdb), checking for attached debuggers, fingerprinting honeypot environments, detecting virtual machine hardware, probing reserved internet addresses that should never respond, and comparing system clocks to detect sandbox time acceleration. If the risk score from these checks exceeds a threshold, the malware erases traces and exits. Command-and-control (C2) communications are encrypted using ChaCha20-Poly1305 for the handshake and AES-GCM for command traffic, with keys derived via HKDF-SHA256 and Curve25519 key exchange, rotated every 10 minutes, and disguised as normal HTTPS traffic. C2 infrastructure leverages free dynamic-DNS services, notably duckdns.org. Supported C2 commands include: start attack, stop attack, report status, switch C2 servers, and upgrade malware. More than 20 IP addresses were observed distributing the malware, with 176.65.139[.]204 being the most active. This IP shares a subnet with infrastructure linked to a separate ADB-targeting DDoS botnet reported in spring 2026.