RustDuck: The IoT Botnet Rewritten in Rust…

QiAnXin XLab has tracked RustDuck since February 2026: a two-stage malware rewritten in Rust with enterprise-grade encryption and anti-analysis controls to recruit IoT devices.

QiAnXin XLab has tracked RustDuck since February 2026. The malware, evolved from earlier code in traditional languages, has rebuilt its core in Rust: the technical choice is not cosmetic but structural. With cryptographic algorithms from an advanced threat actor and a risk-scoring anti-analysis defense system, RustDuck demonstrates that mass cybercrime is adopting engineering standards previously associated with sophisticated actors. The target remains the usual: routers, IP cameras, Android boxes, and misconfigured servers, aggregated into a network for DDoS attacks.

Key Takeaways

RustDuck is a two-stage malware rewritten in Rust, tracked by QiAnXin XLab since February 2026, that recruits IoT devices for DDoS networks.
The communication system uses ChaCha20-Poly1305 for handshake, AES-GCM for commands, HKDF-SHA256 and Curve25519 for key exchange, with rotation every 10 minutes.
Multiple anti-analysis checks calculate a risk score: detection of Wireshark, gdb, VM, honeypot, and sandbox time-dilation; once a threshold is crossed, the malware self-destructs its traces.
Four specific CVEs are documented as compromise vectors, with NVD scores ranging from 6.3 to 9.8, including vulnerabilities on unpatched EOL devices.

Why Rust Changes the Reverse Engineering Game

The core of RustDuck is where the technological investment concentrates. According to XLab, the switch to Rust is not a quick recompile of stolen code but an active rewrite that exploits language properties impossible to replicate in C with the same degree of reliability. Inherent memory safety reduces the crashes that often betray traditional malware during execution; the resulting binaries offer less attack surface for reverse engineering, with less informative symbols and optimizations that complicate disassembly.

This technical aspect has operational consequences. Researchers spend more time on static and dynamic analysis; response times lengthen; the malware's window of effectiveness expands. It is not about making the code "unbreakable" — XLab has analyzed the sample nonetheless — but about raising the cost of analysis to levels previously reserved for threats with larger budgets.

"RustDuck is a small botnet wearing the engineering of a serious one"

The Cryptographic Architecture That Obscures Command and Control

RustDuck implements a cryptographic stack that rivals legitimate enterprise communications. The initial handshake between infected device and command server uses ChaCha20-Poly1305; subsequent commands transit over AES-GCM. Key exchange relies on HKDF-SHA256 and Curve25519. Rotation occurs every 10 minutes, an interval that drastically limits the useful window for decryption in case of key material capture.

The command-and-control infrastructure leans on free dynamic DNS services, particularly duckdns.org, with more than 20 IP addresses identified as distribution servers. The most active, according to XLab, resides in the 176.65.139[.]204 block. This address shares a subnet with servers associated with another ADB-targeting botnet documented in spring 2026; XLab does not confirm an operational link between the two campaigns. The source does not specify whether this is shared hosting, infrastructural coincidence, or a managerial relationship.

How It Picks Victims: Known CVEs and Forgotten Attack Surfaces

RustDuck does not innovate in vector selection but in their systematic combination. Beyond weak or default passwords on Telnet and SSH, and exposed Android Debug Bridge interfaces, the malware exploits specific web vulnerabilities — ThinkPHP, Jenkins, Hadoop YARN — and four documented CVEs.

CVE-2017-17215 affects the Huawei HG532 router with a remote RCE bug; the National Vulnerability Database assigns a CVSS 8.8, and the vulnerability is historically known for abuse by the original Mirai botnet. CVE-2024-1781 hits the Totolink X6000R router with command injection; the NVD records a CVSS 9.8, with the vendor not responding at the time of advisory publication. CVE-2025-29635 concerns the D-Link DIR-823X, an end-of-life device: it is listed in CISA's Known Exploited Vulnerabilities catalog, with evidence of active exploitation by a Mirai variant dubbed tuxnokill, as reported by Akamai. CVE-2018-8007 affects Apache CouchDB with RCE.

The profile is clear: EOL devices, unpatched firmware, unresponsive vendors. The professionalization of malware does not require zero-day vulnerabilities: it merely exploits with efficiency what the market has already abandoned.

"Each hit adds points to a risk score. Cross a threshold, and the malware erases its traces and quits before anyone can watch it run"

Context: When Mass DDoS Learns from APT

RustDuck does not exist in isolation. Spring 2026 saw the U.S. Department of Justice dismantle three massive IoT botnets — AISURU, Kimwolf, JackSkid — with a combined estimated scale of over 31.4 Tbps. XLab assisted investigations into those operations. No evidence directly links RustDuck to those infrastructures. However, the comparison is instructive: while those networks leveraged consolidated code and DDoS-for-hire economic models, RustDuck represents a next step in the evolutionary chain.

A direct precedent in the language exists. Fortinet documented RustoBot in April 2025: that botnet also used Rust, with similar attack patterns (Totolink, DDoS). RustDuck is a more mature variant, not necessarily linked to the same operator. "The switch points to active development, not a quick re-skin of leaked code," as XLab notes. The common element is not the author but the trend: the adoption of Rust as a de facto standard for IoT malware aiming for resilience.

Anti-analysis techniques — debugger detection, fake network tests, clock comparison to identify sandbox time-dilation — have for years been the attribute of advanced or state-sponsored actors. Their appearance in a presumably limited-scale DDoS botnet lowers the barrier to entry for sophisticated capabilities. Buyers of DDoS services on illicit markets no longer need to trust the operator's technical robustness: the malware autonomously guarantees its own concealment.

What to Do Now

Priority actions emerge from the documented attack surface, not from generic prescriptions. On D-Link DIR-823X, Totolink X6000R, and Huawei HG532 devices: the source does not specify available patches for EOL models; the absence of vendor response on CVE-2024-1781 is documented. On servers with ThinkPHP, Jenkins, Hadoop YARN, Apache CouchDB: verify exposure of administrative interfaces on public networks. On Android boxes and generic IoT devices: disable Android Debug Bridge if exposed; the brief does not document further specific configurations.

For detection: the presence of connections to duckdns.org services and traffic with key rotation every 10 minutes constitutes a behavioral indicator, according to XLab. The malware implements silent upgrade and C2 change commands: the initial compromise may not be the final endpoint of the infection.

Questions and Answers

Does the switch to Rust make RustDuck immune to analysis?

No. XLab analyzed the sample and documented its architecture. Rust makes analysis slower and more costly, not impossible. The operational difference lies in defenders' response times, not in the inevitability of the threat.

Why didn't the DoJ include RustDuck in the spring 2026 operations?

The dossier documents no link. The DoJ operations concerned botnets with measurable scale and identifiable infrastructures; RustDuck, by size or evolutionary stage, may not have fallen within that investigative perimeter. XLab does not provide a number of infected devices.

Can infected devices be cleaned remotely?

The source does not document automatic remediation procedures. The malware supports silent upgrade commands: a remote operator can replace the payload, but this does not equate to benign removal.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references