RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow
ID: ddb90114-08ff-53f6-87ea-578db0e12214
STIX ID: report--ddb90114-08ff-53f6-87ea-578db0e12214
Feed Name: Security Affairs
Threat Score
RustDuck is an actively observed but currently small DDoS botnet rapidly evolving from C to Rust; it compromises IoT and server devices using weak/default credentials and known CVEs, employs multi-stage loaders, advanced encryption (ChaCha20-Poly1305, AES-GCM, Curve25519/HKDF), and robust anti-analysis checks, with observed delivery IPs, loader hashes and duckdns-based C2s—mitigation focuses on removing exposed management interfaces, patching or replacing EoL gear, and blocking known IOCs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.