RustDuck: 双阶段僵尸网络深度剖析

**Executive summary:** The report details the discovery and technical analysis of a modular, cross-platform DDoS botnet family dubbed "RustDuck" (Loader + Core architecture) active since Feb 2026; it documents propagation methods (weak credentials, IoT and web RCEs), loader variants and SHA1s, Core cryptography and anti-analysis checks, the Noise-like encrypted C2 protocol, and multiple C2 domains/IPs observed—highlighting the family's migration from C to Rust and its increasing sophistication and resilience.