RustyRocket

RustyRocket is a custom malware platform used by the World Leaks extortion group and first identified and named by Accenture. It is written in Rust and is described as a sophisticated data exfiltration and proxy tool that supports stealthy persistence on victim networks. Accenture reported that it targets both Microsoft Windows and Linux environments, uses heavily obfuscated multi-layer encrypted tunnels to blend malicious traffic into legitimate network activity, and includes an execution guardrail requiring a pre-encrypted configuration at runtime, which makes monitoring and detection more difficult.

In the reported World Leaks intrusion, the actor gained initial access by brute forcing an exposed RDP service using a company-specific wordlist and reused the compromised Administrator credentials to move laterally. On Day 2 of the intrusion, the actor downloaded agent.zip from temp[.]sh to the domain controller, deployed agent.exe to C:\ProgramData\Veeam, and executed it on both the domain controller and backup server. The payload was identified as RustyRocket, with SHA256 743f9dbb32f86322c5f55f1e9051c5cd88092f10adcdac45aa648ac06e229b8a. In that case, RustyRocket ran in NORMAL mode, used SMB over port 445 to collect files from reachable hosts, and exfiltrated data over HTTPS over port 443 to more than 6,900 unique Cloudflare IPs.

RustyRocket is associated with World Leaks’ data-theft-and-extortion operations rather than file encryption. World Leaks has been active since early 2025 and is reported to obtain access through social engineering, stolen credentials, or exploitation of exposed infrastructure. In the cited intrusion, RustyRocket was deployed after the actor had already accessed the domain controller and backup infrastructure, indicating use against high-value enterprise systems and backup environments.