A new two-stage malware family called **RustDuck** is actively hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at **QiAnXin's XLab** have tracked it since February 2026 and say the real story is not how big it is today, but how fast it is changing. The end goal is a distributed denial-of-service (DDoS) attack: flooding a target with junk traffic from the infected machines until it buckles. **RustDuck** is one more entrant in a crowded field, but it stands out for two reasons. It is being rewritten from the C programming language into **Rust**, and its newer versions go to unusual lengths to avoid being studied or shut down. ## How it Spreads **RustDuck** does not lean on a single clever trick. It sprays a mix of old, well-known weaknesses and hopes one sticks. The first is the oldest in the book: devices left on the internet with weak or default passwords on their remote-login services (**Telnet** and **SSH**). Guess the password, walk in. The second is unpatched device bugs. **XLab** says **RustDuck** goes after exposed **Android** debugging interfaces and flaws in gear from **TVT** (DVRs and cameras), **Ruijie**, **TP-Link**, and **ZTE**, plus a handful of named, years-old vulnerabilities that still litter the internet: * **CVE-2017-17215**, a remote code execution bug in **Huawei HG532** routers that the original **Mirai**-style botnets abused back in 2017. * **CVE-2025-29635**, a command-injection flaw in discontinued **D-Link DIR-823X** routers that **Akamai** watched **Mirai** variants exploit in March 2026. **CISA** added it to its **Known Exploited Vulnerabilities** list the next month. * **CVE-2024-1781**, a command-injection bug in **Totolink X6000R** routers, whose maker never responded to the disclosure. * **CVE-2018-8007**, a remote code execution path in **Apache CouchDB** that an authenticated admin can abuse. The third path is web software. **RustDuck** also targets known holes in **ThinkPHP**, **Jenkins**, and **Hadoop YARN**, which stretches its reach from cheap home hardware to exposed server software. **XLab** counted more than 20 internet addresses spreading the malware, with the busiest at `176.65.139[.]204`. ## What Makes it Tricky **RustDuck** installs in two stages: a small loader that decrypts and unpacks a heavier core module. That core is where the interesting engineering lives, and it is the part being rewritten in **Rust**. **Rust** binaries are generally tougher for analysts to take apart than the C that has powered device malware for years, and **XLab** says **RustDuck**'s **Rust** core shows real depth in how it derives its keys, hides from analysis, and talks to its servers. The switch points to active development, not a quick re-skin of leaked code. The bigger tell is how hard the newer samples work to stay hidden. Before doing anything, **RustDuck** runs a checklist to decide whether it has landed in a security researcher's lab instead of on a real victim's device. It looks for analysis tools like **Wireshark** and **gdb**, for debuggers attached to its own process, for the fingerprints of a honeypot trap, even for virtual-machine hardware.  Each hit adds points to a risk score. Cross a threshold, and the malware erases its traces and quits before anyone can watch it run. Two of those checks stand out. One quietly tries to reach an internet address that is reserved for testing and should never answer; if something replies, **RustDuck** knows it is inside a fake network built to fool malware, and bails. Another compares two clocks to catch sandboxes that speed up time to rush malware into showing its hand. Its communications are locked down to match. **RustDuck** encrypts its traffic with modern ciphers: **ChaCha20-Poly1305** for the handshake, **AES-GCM** once it is taking commands. It derives its keys with **HKDF-SHA256** and a **Curve25519** exchange, rotates them every ten minutes, and dresses the connection up to look like ordinary encrypted web traffic so it blends in. Once a device checks in, the operators can send a short list of orders: start an attack, stop it, report status, switch to new control servers, or quietly upgrade the malware to a newer build. The control addresses lean on free dynamic-DNS services like **duckdns.org**, which is where the "Duck" in the name comes from. ## This Fits a Bigger Pattern **RustDuck** is not the first botnet to reach for **Rust**. In April 2025, **Fortinet** documented **RustoBot**, a **Rust**-based botnet that spread through **Totolink** and other routers to run **DDoS** attacks, using the same recipe: cheap routers, a modern language, and flood traffic on demand. It also arrives in a brutal year for **DDoS**. The same kind of botnet, scaled up, has produced the biggest floods on record. **AISURU** and a cluster of related botnets, more than three million hijacked devices between them, drove attacks near 30 Tbps before a US-led operation tore down their infrastructure this spring. Next to that, **RustDuck** is tiny. The worry is the direction it is heading. One detail worth a second look: **RustDuck**'s busiest delivery address, `176.65.139[.]204`, sits in the same small block of addresses as the server behind a separate ADB-targeting **DDoS** botnet reported in spring 2026. That could be a coincidence or shared bulletproof hosting, and **XLab** does not link the two, but the overlap is the kind of thing worth checking. ## What to Do There is no patch for **RustDuck** itself, because it is malware, not a single bug. Defense means closing the doors it walks through: * **Get remote-management interfaces off the public internet.** Turn off **Android Debug Bridge**, **Telnet**, and **SSH** where they are not needed, and never leave them reachable with default passwords. * **Patch what you can, replace what you can't.** **CouchDB** has fixed releases to upgrade to, but some of these routers are past end-of-life. For the **D-Link DIR-823X**, **CISA**'s advice is to pull it from service rather than wait for a patch that isn't coming, and the **Totolink** maker never answered the disclosure. Unsupported gear has to be replaced, not fixed. * **Block the known indicators.** **XLab**'s report lists the malware's file hashes, control domains, and source addresses; feed them into your monitoring. **RustDuck** is a small botnet wearing the engineering of a serious one. Whether it grows into a real threat or fizzles out, the techniques it is testing – a **Rust** rewrite and a paranoid hide-from-researchers routine – are the parts other crews are most likely to borrow.