RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2018-8007 | Apache CouchDB administrative users can configure the database server via HTTP(S) | 7.2 | 12% | PoC | |
| CVE-2024-1781 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719 | 9.8 | 15% | PoC | |
| CVE-2025-29635 | Authenticated Command Injection in D-Link DIR-823X Routers Exploited by Mirai Botnet | 7.2 | 88% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | duckdns.org | he control addresses lean on free dynamic-DNS services like duckdns.org, which is where the "Duck" in the name comes from. This fit |
| ipv4 | 176.65.139.204 | l worth a second look: RustDuck's busiest delivery address, 176.65.139[.]204, sits in the same small block of addresses as the server |
From the original article
5 min read at thehackernews.com
A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin's XLab have tracked it since February 2026, and say the real story is not how big it is today, but how fast it is changing.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.