RustDuck: The Botnet That's Still Small but Engineering Like It Plans to Grow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2018-8007 | Apache CouchDB administrative users can configure the database server via HTTP(S) | 7.2 | 12% | PoC | |
| CVE-2024-1781 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719 | 9.8 | 15% | PoC | |
| CVE-2025-29635 | Authenticated Command Injection in D-Link DIR-823X Routers Exploited by Mirai Botnet | 7.2 | 88% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | duckdns.org | C2 domains lean on free dynamic DNS services, specifically duckdns.org, which is where the name comes from. Once a device checks i |
| ipv4 | 176.65.139.204 | re than 20 IP addresses actively spreading the botnet, with 176.65.139[.]204 the most active delivery source. The XLab researchers rep |
From the original article
6 min read at securityaffairs.com
RustDuck is a small, evolving DDoS botnet migrating to Rust. It uses advanced encryption, anti-analysis evasion, and exploits known IoT flaws. Since February 2026, researchers at QiAnXin’s XLab have been tracking a new malware family, called RustDuck, that hijacks routers, cameras, Android set-top boxes, and exposed servers, then uses them to flood targets with junk traffic until they go offline.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.