RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

**RustDuck** is a newly observed two-stage DDoS botnet targeting poorly secured routers, cameras, Android boxes and exposed servers; it is notable for being rewritten in Rust, using strong encryption (ChaCha20-Poly1305 and AES-GCM with Curve25519/HKDF-SHA256), extensive anti-analysis and sandbox-detection checks, and modular C2 that uses dynamic DNS. XLab observed active spreading since February 2026, provided IOCs (file hashes, control domains, source IPs), and recommends removing public remote-management interfaces, patching or replacing unsupported devices, and blocking known indicators.