Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
RustDuck: An In-Depth Analysis of a Two-Stage Botnet
Excerpt
Overview Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities. Although the…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-29635 | High | Score 64/100 | First seen |
| SHA1 | 4d11bd496da82d15b3ed13050f414e44f5a892d4 | High | Score 56/100 | First seen |
| SHA1 | 6aa791c76b3107fca9d57b7ecea8f46d97d83738 | High | Score 56/100 | First seen |
| IP | 176.65.139.204 | High | Score 63/100 | First seen |
| CVE | CVE-2018-8007 | Medium | Score 54/100 | First seen |
| CVE | CVE-2024-1781 | Medium | Score 54/100 | First seen |
| CVE | CVE-2017-17215 | High | Score 62/100 | First seen |
| SHA1 | 8315f650e9e4f67c00277b076ab304eed23db47d | High | Score 56/100 | First seen |
| SHA1 | d39a3ee96be6b8f5238cb1253514ab55c88f714c | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…