RustDuck Botnet is a two-stage malware family that hijacks Internet connected devices and then groups the compromised devices into a botnet used to launch DDoS attacks.
The security research team at XLab, part of QiAnXin, has tracked RustDuck Botnet since February 2026. The devices RustDuck Botnet targets include home routers, IP cameras, Android boxes and weakly configured servers. Once a device is compromised, RustDuck Botnet keeps it idle and waiting for instructions from a central command and control server.
For small and medium businesses in Vietnam, RustDuck Botnet deserves attention because the targeted device categories match what most offices already run: routers supplied by the ISP, low cost surveillance cameras and internal servers that are rarely patched. Offices without a dedicated IT team usually stop monitoring these devices after installation, and that is exactly the condition RustDuck Botnet needs in order to expand.
Three characteristics separate RustDuck Botnet from earlier generations of DDoS botnets:
According to the XLab report, the current scale of RustDuck Botnet remains modest compared with the IoT botnets already dismantled. What matters about RustDuck Botnet is not the number of compromised devices, but the speed of its development and the level of technical investment behind it.
RustDuck does not rely on a single vulnerability. RustDuck combines several intrusion paths at the same time, targeting both consumer devices and enterprise server infrastructure.
| Target | How RustDuck exploits it |
| Routers, IP cameras | Brute forcing weak or default passwords on the Telnet and SSH remote login services |
| Android boxes | Exploiting the ADB (Android Debug Bridge) debugging port left exposed on the Internet |
| Routers and video recorders from vendors such as TVT, Ruijie, TP-Link, ZTE, Totolink, D-Link | Published CVE vulnerabilities on devices that have not been patched or are no longer supported |
| Servers running Apache CouchDB, ThinkPHP, Jenkins, Hadoop YARN | Known software vulnerabilities, usually tied to patches that were never applied in time |
One pattern stands out across this list: most of these are vulnerabilities disclosed publicly a long time ago, not newly discovered zero-day vulnerabilities. It shows that most devices compromised by RustDuck fall because they were never patched or still use default login credentials, not because the attack technique is especially groundbreaking.
What sets RustDuck apart from many earlier DDoS botnets lies in the malware core, which is being rewritten from C to Rust. Rust binaries are inherently harder to reverse engineer than C, and according to XLab, the Rust core of RustDuck reflects serious technical investment in how encryption keys are generated, how the malware hides from analysis tools and how it communicates with the command server. This is the signature of an actively developed project rather than a copy built on leaked source code.
Even more notable is the self protection mechanism in newer RustDuck builds. Before taking any action, the malware runs a series of checks to determine whether it is sitting in a researcher lab environment or on a genuine victim device, with each suspicious signal adding to a risk score:
Once the risk score crosses the threshold, RustDuck wipes its traces and exits before anyone can observe how it behaves.
Communication between infected devices and the command server is locked down just as tightly. RustDuck encrypts traffic with ChaCha20-Poly1305 for the initial handshake and AES-GCM once commands are exchanged, derives keys with HKDF-SHA256 combined with Curve25519 key exchange, rotates keys every ten minutes and disguises the connection as ordinary encrypted web traffic. The RustDuck command infrastructure relies on free dynamic DNS services, which is also where the word Duck in the botnet name comes from.
RustDuck Botnet is neither the first DDoS botnet written in Rust nor the largest one in operation. Placed alongside recent developments, the broader picture points to a clear trend
Compared with the scale of AISURU, RustDuck Botnet is still very small. What deserves attention is not the current size but the direction of development: a small botnet today can serve as a technical testbed for a far larger attack tomorrow, particularly as the evasion techniques used by RustDuck Botnet continue to be studied and copied by other attack groups.
This is why businesses should not underestimate a DDoS botnet simply because it is still small. Digital infrastructure today runs on a long list of permanently connected devices, from office routers and surveillance cameras to internal servers. Any one of them can become a link in an attack aimed at another organization, or worse, the business that owns the device can become the target itself.
If your business has no protection layer standing between its infrastructure and attacks like these, now is a reasonable time to start, and you can start for free with WAF Free.
Button;Try it now;https://partner.vnetwork.vn/en-US/?utm_source=google&utm_medium=blog&utm_campaign=waf_free&utm_term=rustduckbotnetlagi;_blank
There is no patch for RustDuck, because RustDuck is malware rather than a single vulnerability. Effective defense means closing off every path that RustDuck and similar botnets are exploiting.
Move remote administration interfaces such as ADB, Telnet and SSH out of public reach on the Internet, open them only when genuinely necessary and always change default passwords. This is the simplest intrusion path for RustDuck Botnet and still the most effective one, for the plain reason that many devices remain exactly as they were configured at the factory.
For software still maintained by its developers, such as Apache CouchDB, applying the latest patch is mandatory. For router models or devices the manufacturer no longer supports, a patch may never arrive. In that case, replacing the device is a far safer option than continuing to run hardware with a known vulnerability.
Auditing individual devices only addresses the risk of becoming part of a botnet. A business also needs a protection layer for its own systems so it does not become the target of a botnet controlled by someone else. This is where a dedicated DDoS protection solution becomes necessary, instead of handling each incident manually as it happens.
Before going deeper into how a dedicated security solution handles attacks like RustDuck, your business can start assessing how ready its systems are today with WAF Free.
Button;Try it now;https://partner.vnetwork.vn/en-US/?utm_source=google&utm_medium=blog&utm_campaign=waf_free&utm_term=rustduckbotnetlagi;_blank
VNIS (VNETWORK Internet Security) does not clean RustDuck Botnet malware off an already infected device, because that work belongs to the device owner through password changes, patching or hardware replacement. The role of VNIS is to protect the systems targeted by that attack traffic, whether the traffic comes from RustDuck Botnet or any other DDoS botnet. VNIS handles this with two defense layers working in parallel:
Detection in VNIS is based on behavior and abnormal traffic patterns rather than on the specific botnet strain the traffic comes from, which helps businesses stay operational even while under attack.
Before reaching for multi layer DDoS capability like this, your business can start with a basic protection layer that is free and takes only a few minutes to set up with WAF Free.
Button;Try it now;https://partner.vnetwork.vn/en-US/?utm_source=google&utm_medium=blog&utm_campaign=waf_free&utm_term=rustduckbotnetlagilagi;_blank
RustDuck Botnet points to a simple reality: any Internet connected device with a careless configuration can become part of a far larger attack. The current scale of RustDuck Botnet is still limited, but the detection evasion techniques of RustDuck Botnet are sophisticated enough for other attack groups to imitate. Businesses therefore need active defense on both fronts, auditing internal devices while deploying a multi layer protection stack such as VNIS with a SOC team monitoring 24/7. Contact VNETWORK for advice on a DDoS protection roadmap that fits the scale of your systems.
References: The Hacker News, XLab (QiAnXin)
Not exactly. A virus is a type of malware that replicates itself and spreads between files or systems. A DDoS botnet is a network of devices taken over by malware, which may be a virus, a worm or a trojan, and then used simultaneously to attack a different target. In other words, malware is the intrusion tool, while a botnet is the result of many compromised devices being pooled together to serve one specific attack purpose.
Common signs include devices running unusually slowly, Internet bandwidth being consumed far beyond normal levels with no obvious activity, or devices rebooting frequently on their own. However, RustDuck Botnet is designed to operate quietly and evade detection, so a more reliable approach is an active audit: review remote access logs, change every default password, and check devices against the list of published CVE vulnerabilities.
Yes. DDoS botnets do not target only large enterprises. RustDuck Botnet exploits consumer routers and low cost IP cameras, devices commonly found in small and medium business offices. Beyond the risk of becoming part of a DDoS botnet, a smaller business with thin infrastructure is also easier to knock offline if it becomes the target of a DDoS attack, since dedicated protection is often not in place.
A WAF focuses on protection at the application layer, blocking Layer 7 attacks such as requests that mimic real users in order to overload a website or an API. For large scale DDoS attacks at the infrastructure layer (Layer 3/4), businesses need additional multi layer DDoS capability such as AI Smart Load Balancing and Multi-CDN for full coverage. This is why solutions such as VNIS combine both protection layers instead of stopping at a WAF alone.
The first step is to disconnect the device from the network so it cannot keep sending attack traffic or receiving new commands from the control server. Then restore the device to its original configuration (factory reset) to remove the installed malware, change every administrative password to a strong one, and update the firmware to the latest version if the manufacturer still provides support. For devices past end of support with no patches available, replacing the device is the safer course of action rather than continuing to use it.