RustDuck Botnet Uses Rust Core and Anti-Analysis Checks to Target Routers and Servers
Summary
QiAnXin’s XLab says RustDuck targets routers, cameras, Android boxes and exposed servers for DDoS, using a two-stage loader, a Rust core, sandbox checks and encrypted command traffic. It spreads through weak credentials and known flaws.
Key points
- XLab says RustDuck targets home routers, IP cameras, Android boxes and exposed servers to build a DDoS botnet.
- It spreads through weak or default Telnet and SSH credentials, exposed Android debugging interfaces, known device flaws and vulnerabilities in web software.
- RustDuck uses a two-stage design: a loader decrypts and unpacks a core module that is being rewritten in Rust.
- The malware checks for analysis tools, debuggers, honeypots and virtual machines; a risk score can trigger cleanup and exit.
- Its evasion checks include probing a reserved testing address and comparing clocks to detect accelerated sandbox time.
- XLab describes encrypted command traffic using ChaCha20-Poly1305, AES-GCM, HKDF-SHA256 and Curve25519, with keys rotated every ten minutes.
- Recommended defenses include removing remote-management interfaces from the public internet, disabling unused services, patching or replacing unsupported devices, and blocking known indicators.
Article Details
- Attack Vectors
- RustDuck guesses weak or default passwords on internet-exposed Telnet and SSH remote-login services.
- It targets exposed Android debugging interfaces and unpatched flaws in devices from TVT, Ruijie, TP-Link, and ZTE.
- It exploits known vulnerabilities in exposed ThinkPHP, Jenkins, and Hadoop YARN installations.
- Infected devices are used to flood target websites and online services with traffic in DDoS attacks.
- Defensive Notes
- Remove remote-management interfaces from the public internet; disable Android Debug Bridge, Telnet, and SSH when not needed, and do not leave default passwords in place.
- Patch affected devices and software where possible; replace unsupported equipment that cannot be patched.
- Block and monitor the indicators listed in XLab’s report.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 176[.]65[.]139[.]204 | Reported by XLab as RustDuck's busiest malware-spreading address. |
MITRE ATT&CK
T1110.001 · Password GuessingRustDuck attempts to access exposed Telnet and SSH services using weak or default passwords.T1190 · Exploit Public-Facing ApplicationRustDuck targets exposed, vulnerable device interfaces and web software, including ThinkPHP, Jenkins, and Hadoop YARN.T1497.001 · System ChecksBefore running, RustDuck checks for analysis tools, honeypots, and virtual-machine hardware to identify research or sandbox environments.T1497.003 · Time Based ChecksRustDuck compares clocks to detect sandboxes that accelerate time.T1498.001 · Direct Network FloodThe infected devices form a botnet that floods targets with traffic to disrupt websites and online services.T1568.002 · Domain Generation AlgorithmsRustDuck's control addresses use free dynamic-DNS services, according to the article.T1573.001 · Symmetric CryptographyRustDuck encrypts command-and-control traffic, using ChaCha20-Poly1305 for the handshake and AES-GCM for commands.T1622 · Debugger EvasionRustDuck checks whether debuggers are attached to its process and exits if its risk threshold is met.
Malware
Vendors
RuijieRustDuck goes after exposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter the internet:TP-Linkgoes after exposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter the internet:TVTXLab says RustDuck goes after exposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter theZTEexposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter the internet:
Products
AndroidRustDuck is a new two-stage malware family that compromises home routers, IP cameras, Android boxes, and exposed servers to build a botnet for DDoS attacks.Apache Hadoop YARNRustDuck also targets known holes in ThinkPHP, Jenkins, and Hadoop YARN, which stretches its reach from cheap home hardware to exposed server software.JenkinsRustDuck also targets known holes in ThinkPHP, Jenkins, and Hadoop YARN, which stretches its reach from cheap home hardware to exposed server software.ThinkPHPRustDuck also targets known holes in ThinkPHP, Jenkins, and Hadoop YARN, which stretches its reach from cheap home hardware to exposed server software.
Tools
Android Debug BridgeTurn off Android Debug Bridge, Telnet, and SSH where they are not needed, and never leave them reachable with default passwords.gdbIt looks for analysis tools like Wireshark and gdb, for debuggers attached to its own process, for the fingerprints of a honeypot trap, even for virtual-machine hardware.WiresharkIt looks for analysis tools like Wireshark and gdb, for debuggers attached to its own process, for the fingerprints of a honeypot trap, even for virtual-machine hardware.