RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

A new and rapidly evolving botnet named RustDuck is emerging as a concerning threat in the cybersecurity landscape, leveraging the Rust programming language to compromise vulnerable devices and assemble them into a distributed attack network. Security researchers at QiAnXin's XLab first identified this sophisticated malware family in February 2026, noting that its development pace is more alarming than its current scale. The botnet primarily targets poorly secured internet infrastructure including home routers, IP cameras, Android streaming boxes, and servers with weak security controls.

Once these devices are infected, they become unwilling participants in a coordinated network designed to execute distributed denial-of-service (DDoS) attacks against websites and online services. What sets RustDuck apart from conventional botnets is its implementation in Rust—a language chosen for its performance and security features that make the malware more challenging to detect and analyze. The malware employs a two-stage infection process that enhances its persistence and evasion capabilities while providing attackers with flexible control over compromised systems.

The strategic choice of Rust for this malware's development indicates a sophisticated threat actor attempting to stay ahead of security defenses. Rust's memory safety features and performance characteristics make it increasingly attractive to malware authors despite the programming complexity, potentially signaling a trend toward more robust and resilient malware in the future. Furthermore, the botnet's rapid evolution suggests an active development team that quickly adapts to security countermeasures and incorporates new functionality