Rustobot

RustoBot is a Rust-based Linux/IoT botnet used for DDoS activity. Reporting in the provided content identifies it as an ELF executable often named "bot" and describes it as primarily targeting vulnerable TOTOLINK devices, with additional exploitation of DrayTek routers also reported. Observed initial access vectors include exploitation of TOTOLINK command-injection flaws CVE-2022-26210 and CVE-2022-26187, and the DrayTek vulnerability CVE-2024-12987, which enable remote code execution on affected routers. Fortinet-listed affected devices include TOTOLINK N600R, A830R, A3100R, A950RG, A800R, A3000RU, and A810R, and DrayTek Vigor2960 and Vigor300B. RustoBot supports multiple architectures including arm5, arm6, arm7, mips, mpsl, and x86, with observed payloads often targeting TOTOLINK devices via the mpsl architecture.

Its core capability is launching DDoS attacks. The content states it can perform UDP flood, TCP flood, and Raw IP flood attacks, with tasking received from command-and-control infrastructure specifying method, target IP/port, duration, and packet length. Fortinet also reports that the malware uses XOR-based obfuscation and Global Offset Table manipulation to hinder reverse engineering, and that it uses DNS-over-HTTPS to determine the infected device's public IP.

The malware is associated with campaigns exploiting CVE-2025-55182 ("React2Shell") against organizations including Russian insurance, e-commerce, and IT companies, where attackers occasionally deployed RustoBot alongside XMRig, Kaiji, and Sliver. In one such case, attackers downloaded an ELF binary named "bot" from 176.117.107[.]154, which BI.ZONE identified as RustoBot. The content also states that RustoBot embeds XMRig as a secondary payload for monetization.

Reported command-and-control and related infrastructure includes domains ilefttotolinkalone.anondns[.]net, rustbot.anondns[.]net, bitcoinbandit.anondns[.]net, cryptoenjoyers.anondns[.]net, and dontblockme.anondns[.]net, which were reported resolving to 45.137.201[.]137 in one campaign, as well as dvrhelper[.]anondns[.]net and other C2 domains reported by Fortinet as pointing to 5.255.125[.]150. Victimology in Fortinet reporting was primarily in the technology sector across Japan, Taiwan, Vietnam, and Mexico.