RustDuck is still small, but you should pay attention to the speed at which its operators keep rebuilding it.
Researchers at QiAnXin's XLab have been watching a malware family called RustDuck since February 2026, and the important part is not the size of the botnet. It is the pace. This thing is breaking into home routers, IP cameras, Android set-top boxes and exposed servers, then changing its own plumbing quickly enough to make defenders keep starting over.
According to XLab's writeup, RustDuck herds those devices into a botnet and points the combined traffic at targets chosen by its operators. The end goal is familiar: a distributed denial-of-service attack, where junk traffic floods a website or service until it buckles. You don't need to dress that up. It is one of the oldest online attacks because neglected devices keep making it cheap.
The name comes from two clues researchers found in the code. XLab says early versions of the core payload encrypted three DuckDNS command-and-control domains, and the malware's move from C into Rust supplied the other half. DuckDNS is a free dynamic DNS service. That is not the kind of infrastructure that screams state-backed operation. It looks more like a practical choice by operators who care about speed, convenience and staying disposable.
RustDuck's footprint is still modest. XLab and Security Affairs both describe it as small compared with established DDoS botnets. XLab counted more than 20 internet addresses actively spreading it, with 176.65.139.204 doing most of the distribution work. By botnet standards, that is not an empire.
The engineering is the part that should bother you.
RustDuck runs in two stages. A small loader lands first, decrypts a compressed payload, and hands control to a heavier core module. XLab has already tracked that loader through four variants, each with a different encryption setup. The first used a Linear Congruential Generator with XOR and LZ4 compression. The second moved to Xoshiro128 with hardcoded constants meant to frustrate batch decryption. The third went back to a simpler XOR scheme with a fixed magic string. The fourth added ChaCha20 as its stream cipher.
Four rewrites of the same component in a few months is not normal maintenance. Frankly, it looks like product iteration.
The core module follows the same pattern. As Rust code replaces the C that has powered router and IoT malware for years, key derivation now uses HKDF-SHA256, with some variants rotating time-based keys every ten minutes. Network handshakes use Curve25519-style elliptic curve exchanges for forward secrecy. Transport encryption has also split across branches, with one using lightweight Ascon128 and another using a hybrid of ChaCha20-Poly1305 and AES-GCM. None of those tools is magical on its own. What is unusual is seeing that much cryptographic care inside a home-router botnet that, by XLab's account, started from a much simpler base.
RustDuck does not need clever new exploits to spread. Its operators lean on Telnet and SSH brute-forcing against weak or default passwords, then stack that with known remote-code-execution bugs. According to reporting from The Hacker News and CyberPress, the target list includes Android ADB interfaces, TVT API endpoints, and devices from Ruijie, TP-Link and ZTE, plus web application bugs in ThinkPHP, Jenkins and Apache YARN.
Some of those flaws are old enough to be embarrassing. CVE-2017-17215, a remote code execution bug in Huawei's HG532 router, was already being abused by Mirai variants nine years ago. CVE-2024-1781 affects Totolink's X6000R router, and the vendor never responded to the original disclosure. CVE-2025-29635, a command-injection flaw in the discontinued D-Link DIR-823X, made CISA's Known Exploited Vulnerabilities list this past April. That is the real weakness RustDuck is using: hardware that stayed online long after its owners stopped thinking about it.
This is where the story stops being about Rust. Discontinued routers do not get regular fixes, and most people never learn that a camera, set-top box or old office gateway has become part of somebody else's traffic cannon. A botnet operator does not need a zero-day when an abandoned product and a default password still open the door. Mirai's descendants have lived off that neglect for a decade. RustDuck is simply bringing faster-moving tooling to the same tired pile of exposed devices.
XLab's own assessment is blunt. RustDuck is not yet a major DDoS threat by scale. Its rate of change is what earned the warning. A small botnet that rewrites its loader encryption four times in a few months and keeps splitting into new branches is worth watching before it grows, not after.
Also read: Shanghai Bets on a New Quantum Computing Zone to Beat Rival Chinese Cities • Singapore Will Fine Cloud Giants a Million Dollars for Going Dark • Sakana AI's Ren Ito Joins the UN's New AI for Good Commission
