# RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation

> RustDuck is an active botnet malware campaign exploiting multiple unpatched vulnerabilities in consumer and enterprise devices (routers, DVRs, cameras, web servers) via credential brute-force and vulnerability chaining. Originally tracked since February 2026, the threat has been recently rebuilt in Rust with ChaCha20-Poly1305 and AES-GCM encryption for enhanced C2 resilience. Capable of DDoS attacks, lateral movement, and dynamic C2 switching via free dynamic-DNS services.

- **Published:** 2026-06-30T19:30:00Z
- **Last reviewed:** 2026-06-30T19:30:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1006
- **ID:** TL-2026-1006
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2018-8007

## Description

RustDuck is a sophisticated, actively exploited botnet campaign that targets vulnerable Internet-facing and edge devices across multiple vendors and product categories. The campaign leverages four known CVEs (CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2018-8007) alongside weak credential exploitation via brute-force attacks on Telnet, SSH, and ADB ports to establish initial access. The malware operators employ a two-stage infection model: stage-1 components establish persistence and download stage-2 payloads that execute the full botnet functionality. A significant evolution in June 2026 saw the threat actors rewrite the botnet core in Rust, replacing older C implementations, and deploying modern cryptographic transport (ChaCha20-Poly1305 for key exchange, AES-GCM for command/control encryption). This hardening significantly increases resistance to traffic-based detection and protocol analysis. Post-compromise, the malware establishes persistent backdoor access, disables security features, performs lateral movement to adjacent network segments, and can be remotely instructed to launch large-scale DDoS attacks or further propagate the infection. The C2 infrastructure leverages dynamic-DNS services (notably duckdns.org) to evade static IP-based blocking and enable rapid failover between command servers. Infrastructure analysis ties at least 176 samples back to a single delivery IP (176.65.139.204), suggesting centralized campaign orchestration. Affected device categories span Huawei HG532 routers, D-Link DIR-823X routers, Totolink X6000R WiFi 6 routers, legacy DVRs/NVRs, IP cameras, and any instance of vulnerable Apache CouchDB running with default credentials or admin panels exposed. The campaign's targeting of IoT and edge infrastructure suggests potential objectives including DDoS-for-hire operations, botnet rental to cybercriminals, corporate network reconnaissance via edge device compromise, and large-scale data exfiltration from compromised surveillance systems.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1601 Modify System Image
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1120 Peripheral Device Discovery
- T1210 Exploitation of Remote Services
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1074 Data Staged
- T1561 Disk Wipe
- T1529 System Shutdown/Reboot
- T1496 Resource Hijacking

## Sources

- [RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS](https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html)
- [Huawei Security Notice PSIRT SN-20171130-01: HG532 Remote Code Execution](http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en)
- [NVD CVE-2017-17215: Huawei HG532 Remote Code Execution](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2017-17215)
- [CISA KEV: CVE-2025-29635 - D-Link DIR-823X Command Injection](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635)
- [Akamai Security Research: Mirai Campaign Targets D-Link Devices](https://www.akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-campaign-targets-d-link-devices)
- [NVD CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-29635)
- [NVD CVE-2024-1781: Totolink X6000R AX3000 Command Injection](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1781)
- [VulDB CVE-2024-1781: Totolink X6000R Unauthorized RCE](https://vuldb.com/?id.254573)
- [GitHub PoC: Totolink X6000R AX3000 RCE Exploit](https://github.com/Icycu123/X6000R-AX3000-Wifi-6-Giga/blob/main/2/X6000R%20AX3000%20WiFi%206%20Giga%E7%84%A1%E7%B7%9A%E8%B7%AF%E7%94%B1%E5%99%A8%E6%9C%AA%E6%8E%AA%E6%9D%83rce.md)
- [Apache CouchDB Security Advisory: CVE-2018-8007](https://blog.couchdb.org/2018/07/10/cve-2018-8007/)
- [NVD CVE-2018-8007: Apache CouchDB Privilege Escalation and RCE](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-8007)
- [MDSec Advisory: Apache CouchDB Remote Code Execution Exploitation](https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/)
- [Shodan Search: CouchDB Exposed Instances (2026)](https://www.shodan.io/search?query=couchdb)
- [Censys Search: Huawei HG532 Devices Online (2026)](https://search.censys.io/)
- [MITRE ATT&CK: Exploitation of Vulnerability Technique (T1190)](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1006