Rust Duck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
Summary: Researchers at QiAnXin's XLab have tracked a two-stage malware family called RustDuck since February 2026, which hijacks home routers, IP cameras, Android boxes and poorly secured servers to build a DDoS botnet. It spreads through weak or default Telnet and SSH passwords, unpatched flaws in TVT, Ruijie, TP-Link and ZTE gear and exposed Android debugging interfaces, plus holes in ThinkPHP, Jenkins and Hadoop YARN, and its core module is being rewritten from C into Rust.
Bottom line: XLab counted more than 20 internet addresses spreading RustDuck, and its busiest, 176.65.139[.]204, sits in the same small block as the server behind a separate ADB-targeting DDoS botnet reported in spring 2026 - an overlap XLab does not link but flags as worth checking. The techniques it is testing, a Rust rewrite and a checklist that scores analysis tools, debuggers, honeypots and VM hardware and quits before it can be watched, are the parts other crews are most likely to borrow.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026