RustDuck DDoS botnet activity targeting routers and servers
Malware Activity
Summary
Hide ▲
Show ▼
The RustDuck malware family is hijacking routers, cameras, Android boxes, and servers to assemble a DDoS botnet that can flood targets and knock websites and online services offline. Tracked since February 2026, it is spreading through weak passwords, exposed device interfaces, and multiple old vulnerabilities. Newer samples are being rewritten from C to Rust and add anti-analysis checks plus encrypted command traffic, making the botnet harder to study and shut down.
Related Happenings
C0XMO Gafgyt botnet activity on DD-WRT routers
Malware Activity
H score19
First: 07.06.2026 17:17
Last: 07.06.2026 17:17
Sources 1
About this happening:
The **C0XMO** botnet is spreading through **DD-WRT router firmware** and other internet-facing devices, increasing the pool of systems available for **DDoS** attacks. It exploits...
C0XMO Gafgyt botnet activity on DD-WRT routers
Malware ActivityAbout this happening: The **C0XMO** botnet is spreading through **DD-WRT router firmware** and other internet-facing devices, increasing the pool of systems available for **DDoS** attacks. It exploits...
Xlabs_v1 Mirai-derived ADB DDoS botnet
Malware Activity
H score22
First: 06.05.2026 23:21
Last: 06.05.2026 23:21
Sources 1
About this happening:
The **xlabs_v1** Mirai-derived botnet has been exposed as a **DDoS** tool that abuses **Android Debug Bridge (ADB)** on internet-facing devices, expanding risk to **Android**, rou...
Xlabs_v1 Mirai-derived ADB DDoS botnet
Malware ActivityAbout this happening: The **xlabs_v1** Mirai-derived botnet has been exposed as a **DDoS** tool that abuses **Android Debug Bridge (ADB)** on internet-facing devices, expanding risk to **Android**, rou...
TBK DVR command injection flaw actively exploited (CVE-2024-3721)
Vulnerability
H score1
First: 20.04.2026 16:01
Last: 20.04.2026 16:01
Sources 1
About this happening:
The **CVE-2024-3721** command injection flaw in **TBK DVR systems** is being actively exploited to gain access and install **Nexcorium** malware. Attackers abuse **crafted request...
TBK DVR command injection flaw actively exploited (CVE-2024-3721)
VulnerabilityAbout this happening: The **CVE-2024-3721** command injection flaw in **TBK DVR systems** is being actively exploited to gain access and install **Nexcorium** malware. Attackers abuse **crafted request...
Aisuru, KimWolf, JackSkid, and Mossad botnet C2 takedown
Law Enforcement
H score20
First: 20.03.2026 10:05
Last: 20.03.2026 10:05
Sources 1
About this happening:
The **U.S. Department of Justice** announced the arrest of **Jacob Butler (aka Dort)**, a **23-year-old** in **Ottawa, Canada**, for allegedly developing and operating the **Kimwo...
Aisuru, KimWolf, JackSkid, and Mossad botnet C2 takedown
Law EnforcementAbout this happening: The **U.S. Department of Justice** announced the arrest of **Jacob Butler (aka Dort)**, a **23-year-old** in **Ottawa, Canada**, for allegedly developing and operating the **Kimwo...
SocksEscort criminal proxy-service ecosystem monetizing residential routers
Threat Actor Meta
H score36
First: 13.03.2026 07:26
Last: 13.03.2026 07:26
Sources 1
About this happening:
The **SocksEscort** proxy-service ecosystem turned compromised residential routers into a rentable abuse platform, letting criminal customers hide behind **369,000 IP addresses**...
SocksEscort criminal proxy-service ecosystem monetizing residential routers
Threat Actor MetaAbout this happening: The **SocksEscort** proxy-service ecosystem turned compromised residential routers into a rentable abuse platform, letting criminal customers hide behind **369,000 IP addresses**...
Timeline
-
30.06.2026 20:45 2 articles · 4h ago
RustDuck botnet hijacks routers and servers for DDoS
Initial DisclosureRustDuck is a new two-stage malware family that hijacks home routers, IP cameras, Android boxes, and poorly secured servers to build a DDoS botnet, while newer samples are rewritten from C to Rust and hardened with anti-analysis checks, encrypted command traffic, and dynamic-DNS control infrastructure. The malware spreads through weak or default passwords, exposed Android Debug Bridge interfaces, and old flaws in devices and server software, and its operators can start or stop attacks, report status, switch control servers, or upgrade the malware to a newer build.
Show sources
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS — thehackernews.com — 30.06.2026 20:45
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS — thehackernews.com — 30.06.2026 20:45