Built with a two-stage Loader + Core design and increasingly written in Rust, RustDuck is notable for rapid technical iteration, strong anti-analysis features, and a wide set of infection methods.
Its primary goal so far is large-scale DDoS, but its propagation techniques let it reach routers, cameras, Android devices and servers a broad and growing attack surface.
RustDuck spreads by combining weak-password brute force and multiple remote code execution (RCE) exploits.
Observed access methods include Telnet and SSH credential guessing and exploitation of flaws in Android ADB, TP-Link and ZTE device firmware, and enterprise products such as Jenkins.
Past CVEs and legacy device bugs are re-used alongside newer flaws to maximize coverage.
The campaign mixes three propagation strategies, weak passwords, IoT device vulnerabilities, and web application RCEs. This allows automated mass compromise across home and enterprise equipment.
RustDuck Botnet Expands Attacks
Researchers have seen more than 20 IPs actively spreading the botnet. The implant chain commonly begins with small loader binaries that unpack and run a compressed core payload, enabling automated scanning and payload delivery at scale.
RustDuck’s loader stage has evolved through at least four distinct variants. Loaders follow a simple pattern: a compact loader stub embedded in an ELF file, followed by compressed core data and a configuration blob.
Variants differ in config size, encryption algorithm and decompression method. Early loaders used simple LCG-based XOR and LZ4 decompression.
Later ones moved to stronger primitives such as Xoshiro128 PRNG, ChaCha20 encryption, and different compression schemes.
This change makes bulk static analysis harder, some loaders include dynamic constants and noise fields that prevent uniform batch decryption.
The evolution demonstrates the author’s focus on raising the difficulty for automated unpacking and signature-based detection.
The botnet’s core stage shows a clear move to Rust and increased engineering sophistication. Key derivation now uses HKDF-SHA256 and sometimes time-based dynamic keys that rotate every 10 minutes.
The network handshakes use Curve25519-like ECDH patterns to gain forward secrecy. For transport, RustDuck variants have split into branches using lightweight Ascon128 or hybrid ChaCha20-Poly1305 then AES-GCM schemes.
This layered cryptography reduces the chances of traffic decryption by defenders. Qianxin said, Anti-analysis techniques are aggressive and multi-layered.
The core implements a weighted risk scoring system that runs many checks detecting popular debuggers, sandbox fingerprints, virtual MAC OUIs, honeypot files, time inconsistencies, quick network connections to reserved test IPs, and more.
If the runtime score crosses a threshold, the program erases traces and exits. These checks complicate dynamic analysis in sandboxes and make researcher work slower and less reliable.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
