RustDuck Botnet Hijacks Home Routers While Evading Researchers

A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, stitching them together into a network built specifically to knock websites and online services offline through distributed denial-of-service attacks. QiAnXin’s XLab researchers have tracked the malware since February 2026 and say the real story isn’t its current scale, but how rapidly it continues evolving, including a full rewrite from C into Rust and unusual, deliberate efforts to avoid being studied or shut down. The discovery lands alongside GoSerpent, a previously undocumented malware family targeting government and diplomatic entities across Southeast Asia, and a new 2026 Bitdefender Cybersecurity Assessment revealing a series of surprising contradictions between how security leaders and frontline practitioners actually perceive their own organizations’ defenses.

Why RustDuck’s Rapid Evolution Deserves Genuine Attention

RustDuck’s specific evolution from C to Rust represents a deliberate technical choice with genuine defensive implications, since Rust’s memory safety features can make the resulting malware binaries considerably more difficult for security researchers to reverse-engineer and analyze compared to equivalent C-based malware, even as the underlying attack capability remains functionally similar. Combined with the malware’s specific efforts to avoid study and shutdown, this rewrite suggests RustDuck’s operators are prioritizing long-term operational resilience and researcher evasion just as much as raw attack capability.

• It exploits volume over precision — RustDuck sprays a mix of old, well-known weaknesses across a broad range of device types rather than relying on a single sophisticated exploit, meaning basic security hygiene across many common devices matters more than defending against one specific vulnerability
• Consumer IoT devices remain a persistently soft target — home routers, IP cameras, and Android boxes are frequently deployed with default credentials or outdated firmware that most consumers never actively maintain or update
• DDoS infrastructure represents a genuinely durable criminal business model — botnets built for distributed denial-of-service capability can be rented out to other criminal actors or used directly for extortion, giving RustDuck’s operators multiple monetization paths regardless of the network’s ultimate specific use

GoSerpent Targets Southeast Asian Governments for Long-Term Access

Kaspersky has uncovered GoSerpent, a previously undocumented malware family put to use in cyberattacks specifically targeting government and diplomatic entities across Southeast Asia since late 2025, with the campaign’s clear focus on long-term access and intelligence gathering rather than immediate financial extortion. This kind of patient, espionage-focused campaign targeting diplomatic infrastructure specifically reflects the broader pattern of state-linked cyber operations prioritizing sustained, undetected access over the faster financial monetization that characterizes most criminal ransomware and DDoS operations covered elsewhere.

Bitdefender’s Survey Reveals Genuine Organizational Blind Spots

The 2026 Bitdefender Cybersecurity Assessment, based on an independent survey of 1,200 IT and cybersecurity professionals across six countries, reveals several genuinely significant contradictions within organizational security postures. IT and security leaders believe they have sufficient visibility into employee AI usage, while many frontline practitioners directly disagree, and while security teams broadly understand the importance of reducing attack surface, many report lacking the actual skills, resources, or strategy needed to accomplish it in practice. Perhaps most notably, the survey found that AI dominates current cybersecurity conversations even as this focus sometimes draws attention away from more prevalent, already-damaging attack techniques.

This leadership-versus-frontline perception gap deserves genuine attention from security executives specifically, since a persistent disconnect between how leadership believes security operations are functioning and how practitioners on the ground actually experience day-to-day reality can lead to genuinely misallocated resources and false confidence in an organization’s actual security posture.

ClickFix’s Ecosystem Continues Mushrooming

Dark Reading reports that ClickFix’s broader criminal ecosystem continues mushrooming, demanding genuinely new defense tactics from security teams, extending the industrialized, API-driven ClickFix infrastructure already documented in Bert-Jan Pals’s earlier OrangeCon research covered in previous weeks. This continued ecosystem growth reinforces that ClickFix has moved well beyond a single technique into a broad, actively evolving criminal infrastructure category requiring sustained, dedicated defensive attention rather than a one-time detection signature update.

What Organizations and Individuals Should Do Now

Home and small office network owners should specifically verify their routers, IP cameras, and any Android-based streaming boxes are running current firmware and have changed default administrative credentials, given RustDuck’s specific, ongoing targeting of exactly these device categories. Government agencies and diplomatic institutions across Southeast Asia specifically should treat GoSerpent as an active, credible espionage threat warranting immediate threat-hunting attention given the campaign’s demonstrated long-term access focus. And security leadership teams should take Bitdefender’s leadership-practitioner perception gap seriously enough to conduct genuine, anonymous frontline staff surveys of their own, rather than assuming existing organizational visibility and resource allocation assessments accurately reflect ground-level reality.

RustDuck’s rapid evolution and GoSerpent’s patient, long-term espionage focus both illustrate genuinely different but equally concerning threat patterns unfolding simultaneously in 2026: opportunistic, broadly targeted criminal infrastructure evolving specifically to evade researcher scrutiny, and patient, sophisticated state-linked campaigns prioritizing sustained access over rapid financial monetization.

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous