RustDuck Botnet Evolves to Target IoT Devices with Advanced Techniques

• •RustDuck botnet targets IoT devices and servers using weak passwords and known vulnerabilities.
• •The botnet employs advanced encryption and anti-analysis techniques, complicating detection.
• •Researchers are tracking its rapid evolution, indicating potential for significant future impact.

The RustDuck botnet, first identified in early 2026, is rapidly evolving by migrating from C to Rust, enhancing its evasion and encryption capabilities. It targets various IoT devices, including routers and cameras, as well as enterprise servers, exploiting vulnerabilities such as CVE-2017-17215 and employing brute-force attacks on weak credentials. The botnet utilizes a two-stage architecture for infections and incorporates strong encryption methods like ChaCha20-Poly1305 and AES-GCM. Researchers from QiAnXin XLab are closely monitoring its development due to its sophisticated anti-analysis measures and potential for growth. Although currently small, its adaptability and technological advancements present a significant threat to cybersecurity. Security professionals are urged to remain vigilant against this evolving threat.