Threat reportMalwareTL-2026-1006
RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation
RustDuck Botnet Rebuilt in Rust with Enhanced C2 (TL-2026-1006), also tracked as RustDuck, is a critical-severity malware campaign scored CVSS 9.2, first published 2026-06-30. It has no confirmed attribution, affects Huawei Technologies Co., Ltd. HG532 Router, references 4 CVEs (CVE-2017-17215, CVE-2025-29635, CVE-2024-1781), maps to 36 MITRE ATT&CK techniques (T1016, T1027, T1041), and is covered by 9 detection rules and 26 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 36MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-1006
- Threat ID
- TL-2026-1006
- Also known as
- RustDuck, Mirai-RustDuck
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, small-medium-business, government administration, health, financial-services, telecoms, energy
- Target regions
- north-america, europe, asia-pacific, middle-east
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in RustDuck Botnet Rebuilt in Rust with Enhanced C2
Malware and tooling: RustDuck, Custom C2 protocol (ChaCha20-Poly1305 + AES-GCM), Mirai
How RustDuck Botnet Rebuilt in Rust with Enhanced C2 works
RustDuck is an active botnet malware campaign exploiting multiple unpatched vulnerabilities in consumer and enterprise devices (routers, DVRs, cameras, web servers) via credential brute-force and vulnerability chaining. Originally tracked since February 2026, the threat has been recently rebuilt in Rust with ChaCha20-Poly1305 and AES-GCM encryption for enhanced C2 resilience. Capable of DDoS attacks, lateral movement, and dynamic C2 switching via free dynamic-DNS services.
RustDuck is a sophisticated, actively exploited botnet campaign that targets vulnerable Internet-facing and edge devices across multiple vendors and product categories. The campaign leverages four known CVEs (CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2018-8007) alongside weak credential exploitation via brute-force attacks on Telnet, SSH, and ADB ports to establish initial access. The malware operators employ a two-stage infection model: stage-1 components establish persistence and download stage-2 payloads that execute the full botnet functionality. A significant evolution in June 2026 saw the threat actors rewrite the botnet core in Rust, replacing older C implementations, and deploying modern cryptographic transport (ChaCha20-Poly1305 for key exchange, AES-GCM for command/control encryption). This hardening significantly increases resistance to traffic-based detection and protocol analysis. Post-compromise, the malware establishes persistent backdoor access, disables security features, performs lateral movement to adjacent network segments, and can be remotely instructed to launch large-scale DDoS attacks or further propagate the infection. The C2 infrastructure leverages dynamic-DNS services (notably duckdns.org) to evade static IP-based blocking and enable rapid failover between command servers. Infrastructure analysis ties at least 176 samples back to a single delivery IP (176.65.139.204), suggesting centralized campaign orchestration. Affected device categories span Huawei HG532 routers, D-Link DIR-823X routers, Totolink X6000R WiFi 6 routers, legacy DVRs/NVRs, IP cameras, and any instance of vulnerable Apache CouchDB running with default credentials or admin panels exposed. The campaign's targeting of IoT and edge infrastructure suggests potential objectives including DDoS-for-hire operations, botnet rental to cybercriminals, corporate network reconnaissance via edge device compromise, and large-scale data exfiltration from compromised surveillance systems.
MITRE ATT&CK techniques used in TL-2026-1006
Discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1120 Peripheral Device Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1572 Protocol Tunneling; T1573 Encrypted Channel
collection
credential-access
Credential Access
T1110 Brute Force; T1552 Unsecured Credentials
Collection
T1113 Screen Capture; T1213 Data from Information Repositories
Privilege Escalation
T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Persistence
T1136 Create Account; T1547 Boot or Logon Autostart Execution
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
Lateral Movement
T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material
Impact
T1496 Resource Hijacking; T1529 System Shutdown/Reboot; T1561 Disk Wipe
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information
defense-impairment
Affected products and versions in RustDuck Botnet Rebuilt in Rust with Enhanced C2
- Huawei Technologies Co., Ltd. — HG532 Router
Vulnerable versions: customized versions
Fixed in: Apply vendor advisory PSIRT SN-20171130-01 - D-Link Corporation — DIR-823X Router
Vulnerable versions: firmware versions 240126; firmware version 240802
Fixed in: Apply latest firmware patch - Totolink — X6000R AX3000 WiFi 6 Router
Vulnerable versions: 9.4.0cu.852_20230719
Fixed in: Device replacement recommended (vendor unresponsive) - Apache Software Foundation — Apache CouchDB
Vulnerable versions: all versions < 1.7.2; versions 2.0.0 to 2.1.1
Fixed in: 1.7.2 and later; 2.1.2 and later - Multiple — IP Cameras, DVRs, NVRs (any model with default Telnet/SSH credentials)
Vulnerable versions: devices with unchanged default credentials
Fixed in: enforce strong unique credentials
Remediation for RustDuck Botnet Rebuilt in Rust with Enhanced C2
Patches
- Huawei HG532: Apply vendor firmware updates per PSIRT SN-20171130-01 (CVE-2017-17215)
- D-Link DIR-823X: Upgrade firmware to patched version (CVE-2025-29635 CISA KEV)
- Totolink X6000R: Vendor unresponsive; recommend device replacement (CVE-2024-1781)
- Apache CouchDB: Upgrade to 1.7.2, 2.1.2, or later (CVE-2018-8007)
Immediate actions
- Block C2 IOCs (IP ranges 176.65.139.0/24, duckdns.org domain on egress)
- Monitor for exploitation attempts on ports 22, 23, 37215 (Huawei), 5984 (CouchDB)
- Scan network for suspicious processes spawning bash/sh from web applications
- Inventory all Huawei HG532, D-Link DIR-823X, Totolink X6000R, and Apache CouchDB instances
- Isolate or patch devices running vulnerable software versions immediately
Workarounds
- Disable remote administration interfaces if not required
- Enforce network access controls restricting device administration to internal IPs only
- Rate-limit or block credential brute-force attempts at firewall/WAF level
- Disable Telnet/SSH if not needed; use SSH key-only auth if required
Longer-term hardening
- Replace unsupported legacy routers/DVRs/cameras with modern hardware
- Enforce multi-factor authentication on administrative panels
- Implement network segmentation to prevent lateral movement from IoT/edge devices to production systems
- Deploy behavioral EDR on critical infrastructure to detect reverse shells and lateral movement
- Enable DPI inspection for unusual encrypted traffic patterns (ChaCha20-Poly1305 TLS anomalies)
- Audit CouchDB deployments for exposed admin APIs; upgrade to 1.7.2+ or 2.1.2+
CVEs associated with RustDuck Botnet Rebuilt in Rust with Enhanced C2
CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2018-8007
Weaknesses (CWE) in RustDuck Botnet Rebuilt in Rust with Enhanced C2
Timeline of RustDuck Botnet Rebuilt in Rust with Enhanced C2
- Huawei publishes security notice for CVE-2017-17215 (HG532 RCE); vulnerability exists in multiple customized router firmware versions
- NVD publishes CVE-2017-17215 with CVSS 3.0 8.8 HIGH severity; Huawei HG532 remote code execution via port 37215
- Apache CouchDB security advisory for CVE-2018-8007; admin privilege escalation allows arbitrary RCE; affects CouchDB < 1.7.2 and 2.0.0-2.1.1
- Public exploit for CVE-2024-1781 published on GitHub; Totolink X6000R command injection in /cgi-bin/cstecgi.cgi setWizardCfg function confirmed exploitable
- NVD publishes CVE-2024-1781 with CVSS 3.1 9.8 CRITICAL severity; Totolink X6000R AX3000 WiFi 6 router unauthenticated RCE
- NVD publishes CVE-2025-29635 (D-Link DIR-823X command injection); CVSS 3.1 7.2 HIGH; exploitation in-the-wild noted
- RustDuck botnet campaign tracking begins; initial two-stage infection model observed targeting unpatched routers and DVRs; brute-force credential attacks on SSH/Telnet/ADB ports documented
- Akamai security research confirms active Mirai-derivative botnet leveraging CVE-2025-29635 against D-Link devices; campaign spreading rapidly
- CISA adds CVE-2025-29635 (D-Link DIR-823X) to Known Exploited Vulnerabilities catalog; marks active exploitation and required patching
- Threat researchers identify delivery IP 176.65.139.204 as central distribution point for RustDuck samples; 176+ malware samples tied to single infrastructure
- RustDuck malware rewrite completed; botnet core ported to Rust programming language with ChaCha20-Poly1305 key exchange and AES-GCM command encryption deployed
- Updated RustDuck samples observed leveraging duckdns.org dynamic-DNS service for C2 failover; enhanced resilience to static IP blocking
- The Hacker News publishes comprehensive threat report on RustDuck botnet rebuilding in Rust; widespread awareness of active campaign targeting routers, DVRs, cameras, and servers
Sources cited for RustDuck Botnet Rebuilt in Rust with Enhanced C2
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
- Huawei Security Notice PSIRT SN-20171130-01: HG532 Remote Code Execution
- NVD CVE-2017-17215: Huawei HG532 Remote Code Execution
- CISA KEV: CVE-2025-29635 - D-Link DIR-823X Command Injection
- Akamai Security Research: Mirai Campaign Targets D-Link Devices
- NVD CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability
- NVD CVE-2024-1781: Totolink X6000R AX3000 Command Injection
- VulDB CVE-2024-1781: Totolink X6000R Unauthorized RCE
- GitHub PoC: Totolink X6000R AX3000 RCE Exploit
- Apache CouchDB Security Advisory: CVE-2018-8007
- NVD CVE-2018-8007: Apache CouchDB Privilege Escalation and RCE
- MDSec Advisory: Apache CouchDB Remote Code Execution Exploitation
- Shodan Search: CouchDB Exposed Instances (2026)
- Censys Search: Huawei HG532 Devices Online (2026)
- MITRE ATT&CK: Exploitation of Vulnerability Technique (T1190)
Detection coverage for TL-2026-1006
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1006 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.