RustDuck Malware Makes Case for Security-By-Design

RustDuck is a rapidly evolving botnet that uses a two-stage Loader and Core architecture to infect IP cameras, home routers, Android devices and servers via weak Telnet/SSH credentials, exposed ADB services, and known RCE vulnerabilities; its developers are migrating components from C to Rust and adopting polymorphic encoding and updated encryption to evade detection and enable large-scale DDoS operations. The report documents observed spreading activity, cites multiple historical CVEs and affected products (TP-Link, ZTE, Ruijie, ThinkPHP, Jenkins, YARN), and recommends actions including changing default credentials, applying firmware patches, segmenting IoT/OT devices, behavioral monitoring, traffic filtering, and automated cyber-hygiene.