# RustDuck: A Modern Botnet Built on Rust Reveals IoT's Persistent Security Crisis


A newly discovered botnet family called RustDuck is rapidly recruiting compromised IoT devices and servers into a distributed attack network, according to research from QiAnXin's XLab. Since February 2026, the malware has demonstrated an aggressive evolution pattern, rewritten in Rust and designed to hijack a diverse range of targets—from home routers and IP cameras to Android boxes and internet-accessible servers—for large-scale DDoS operations.


The emergence of RustDuck underscores a troubling trend: despite years of warnings about insecure IoT ecosystems, the fundamental vulnerabilities that enable botnet recruitment remain largely unpatched and widespread.


## The Threat


RustDuck operates as a two-stage malware family that deploys an initial payload to establish a foothold, then downloads and executes the main botnet client. Once installed, the malware integrates infected devices into a botnet infrastructure optimized for coordinated denial-of-service attacks.


The botnet's targeting strategy is notably broad:


  • Consumer routers — typically configured with default credentials or outdated firmware
  • IP cameras and surveillance systems — widely deployed with minimal security hardening
  • Android boxes and media devices — often running outdated OS versions without security patches
  • Poorly secured servers — including Linux systems exposed on public internet with weak authentication

    • The choice to rewrite the botnet in Rust is significant. Rust's memory safety guarantees and low-level control make it an attractive language for malware developers seeking to build reliable, exploitable code that resists certain classes of vulnerabilities while maintaining performance across heterogeneous hardware.


    ## Background and Context


    Botnets have long served as the workhorses of cybercriminal operations. Unlike single-purpose malware, botnet infrastructure provides flexibility—it can be rented out for DDoS attacks, used to distribute spam or phishing campaigns, or repurposed for cryptocurrency mining. The scale and persistence of botnet operations depend almost entirely on the availability of vulnerable devices.


    Why IoT remains vulnerable:


    | Factor | Impact |

    |--------|--------|

    | Default credentials | Millions of devices ship with unchanged admin passwords |

    | Firmware abandonment | Manufacturers stop releasing patches after 1-2 years |

    | Lack of monitoring | Most consumers never review device logs or traffic |

    | Legacy protocols | Older devices run outdated network services with known flaws |

    | Supply chain gaps | Third-party components often contain unpatched vulnerabilities |


    RustDuck's emergence in February 2026 follows a pattern we've seen repeatedly: malware families evolve from C/C++ or Go implementations into Rust as the language matures for systems-level programming. The shift suggests that botnet operators are investing in longevity and stealth—hallmarks of a threat actors moving beyond one-off campaigns toward sustained operations.


    ## Technical Details


    ### Two-Stage Infection


    RustDuck employs a staged delivery mechanism to avoid detection and maximize persistence:


    1. Stage 1 — Initial Loader: A lightweight dropper, typically distributed via exploitation of known vulnerabilities or brute-forced credentials, downloads and executes the main payload.


    2. Stage 2 — Botnet Client: The Rust-based botnet client establishes a connection to the command-and-control (C2) infrastructure, registers the newly compromised device, and awaits instructions.


    This approach reduces the attack surface of the initial compromise and allows operators to update the botnet logic without re-delivering the entire payload.


    ### Exploitation Vectors


    Infection occurs through multiple pathways:


  • Unpatched services — Routers and cameras running web interfaces with known CVEs
  • Brute force attacks — SSH, Telnet, and HTTP authentication endpoints targeted with common credential dictionaries
  • Supply chain compromises — Pre-infected firmware or compromised update channels
  • Social engineering — Tricking users into accessing malicious URLs or entering credentials

    • ### Rapid Evolution


    According to QiAnXin researchers, RustDuck's most notable characteristic is its speed of change. The botnet undergoes frequent updates to its C2 communication protocol, obfuscation techniques, and operational behavior. This suggests active development and a sophisticated threat actor willing to invest resources in maintaining the botnet's effectiveness against evolving defenses.


    ## Implications


    ### Scale and Scope


    The breadth of RustDuck's target list—consumer devices, enterprise systems, and everything in between—indicates that operators are adopting an indiscriminate recruitment strategy. Volume matters more than specificity; a botnet with millions of smaller devices can generate substantial DDoS traffic, and even a small percentage of compromised servers can provide computational power for other attacks.


    ### Attack Surface


    Organizations are at risk on multiple fronts:


  • Network-adjacent risk: Compromised routers on the same network as critical systems can be leveraged for lateral movement or man-in-the-middle attacks.
  • DDoS targeting: Organizations themselves may be targets of botnet-driven DDoS campaigns, disrupting service availability.
  • Credential theft: IoT devices often run unencrypted management protocols (HTTP, Telnet) that can leak credentials to monitoring systems or databases.

    • ### Ongoing Threat


    The fact that RustDuck continues to evolve and recruit new devices suggests this is not a isolated malware sample but an active, ongoing operation. Threat actors behind the botnet are likely monetizing access through DDoS-for-hire services or selling compromised device access to other actors.


    ## Recommendations


    ### For Consumers


  • Change default credentials on all connected devices (routers, cameras, smart home systems)
  • Update firmware regularly — enable automatic updates where available
  • Disable unnecessary services — turn off remote management, SSH, or Telnet if not actively used
  • Segment networks — isolate IoT devices on a separate VLAN if your router supports it

    • ### For Organizations


  • Inventory all connected devices — maintain a catalog of routers, cameras, printers, and other networked equipment
  • Apply patches promptly — prioritize firmware updates for internet-facing devices
  • Monitor for anomalous outbound traffic — botnet communication often exhibits recognizable patterns (repeated connections, large data transfers)
  • Implement network segmentation — limit what compromised IoT devices can reach internally
  • Review DDoS protection services — ensure adequate capacity to withstand volumetric attacks

    • ### For Infrastructure Providers


  • Harden default configurations — ship devices with unique, randomly generated credentials
  • Enforce security during development — use secure coding practices and memory-safe languages where feasible
  • Establish firmware support timelines — commit to security patches for at least 5 years post-launch
  • Implement signed boot and code signing — make it harder for attackers to modify firmware

    • ---


    ## HackWire Analysis


    The Real Story: Infrastructure Decay Meets Sophisticated Operators


    RustDuck's emergence is significant not because it introduces novel attack vectors, but because it demonstrates that the IoT security crisis has matured into a persistent, well-resourced operational infrastructure. The decision to rewrite in Rust reflects a fundamental shift: botnet operators are no longer treating these as one-off tools, but as long-lived platforms requiring continuous investment.


    What makes this particularly concerning is the *scale invisibility*. A single organization might never know if their router has been compromised. There's no user-visible impact—the botnet silently siphons bandwidth and processing power. Aggregated across millions of devices, this becomes a major force multiplication for attackers capable of coordinating DDoS campaigns that dwarf those from even a few years ago.


    The targeting of Android boxes and media devices deserves special attention. These products occupy a gray market zone: they're often sourced from third-party vendors, run outdated Android versions that stopped receiving updates years ago, and include minimal security hardening. Yet they're deployed in homes, businesses, and institutions worldwide. A compromised Android box in an office network becomes a staging point for internal reconnaissance.


    From a defender's perspective, the broader lesson is uncomfortable: you cannot secure a network if you cannot see or control all devices on it. Most organizations have a tenuous grasp on their IoT inventory. Routers purchased years ago still run firmware from 2021. Security cameras installed for compliance sit unmonitored. The infrastructure that connects your critical systems to the internet remains a blindspot.


    RustDuck will likely continue evolving and recruiting. The operators behind it have demonstrated competence and persistence. The only meaningful mitigation is a shift toward inventory visibility, mandatory firmware update policies, and network segmentation—unglamorous, expensive work that most organizations defer until after an incident occurs.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [DDoS Attacks](https://www.hackwire.news/category/ddos) and [IoT Security](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)