New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits

Gbhackers •Mayura Kathir • July 1, 2026

A sophisticated new botnet family dubbed RustDuck emerged in early 2026, leveraging a two-stage Loader and Core architecture to compromise IoT devices, routers, and enterprise servers through brute-force credential attacks and remote code execution vulnerabilities. RustDuck employs a multi-pronged infection strategy combining weak password attacks against Telnet and SSH services with exploitation of known RCE […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RustDuck Botnet Evolves to Target IoT Devices with Advanced Techniques The RustDuck botnet, first identified in early 2026, is rapidly evolving by migrating from C to Rust, enhancing its evasion and encryption capabilities. It targets various IoT devices, including routers and cameras, as well as enterprise servers, exploiting vulnerabilities such as CVE-2017-17215 and employing brute-force attacks on weak credentials. The botnet utilizes a two-stage architecture for infections and incorporates strong encryption methods like ChaCha20-Poly1305 and AES-GCM. Researchers from QiAnXin XLab are closely monitoring its development due to its sophisticated anti-analysis measures and potential for growth. Although currently small, its adaptability and technological advancements present a significant threat to cybersecurity. Security professionals are urged to remain vigilant against this evolving threat. 5 sources 65

Extracted Entities

New RustDuck Botnet Targets IoT Devices and Servers With Weak Passwords and RCE Exploits

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (2)