the RustoBot Botnet: A New Threat to Network Devices

FortiGuard Labs has discovered an advanced botnet known as “RustoBot,” which utilizes the increasingly popular Rust programming language. This malware exploits vulnerabilities in certain network devices, particularly routers, to create a new wave of cyber threats. The botnet’s use of Rust offers a highly sophisticated and evasive means of attack, further complicating the work of cybersecurity experts.

As cybercriminals evolve their tactics, RustoBot marks a significant shift toward more powerful and stealthy malware. By leveraging command injection vulnerabilities in TOTOLINK routers and DrayTek devices, the botnet exploits weaknesses that allow attackers to remotely execute code and hijack vulnerable systems. This article will delve deeper into RustoBot’s modus operandi, the vulnerabilities it exploits, and the measures organizations can take to mitigate the threat.

RustoBot: An Overview of the Threat

RustoBot is a sophisticated botnet that targets specific vulnerabilities in network devices, including TOTOLINK routers and certain DrayTek models. These vulnerabilities are found in the cstecgi.cgi component of TOTOLINK routers and a recently identified flaw in DrayTek Vigor devices. The botnet operates by exploiting these vulnerabilities to inject commands remotely, gaining unauthorized access to the devices.

Once compromised, RustoBot delivers a malware payload via downloader scripts, which utilize multiple methods such as wget and tftp for distribution. The botnet is designed to target embedded architectures, including arm5, arm6, arm7, mips, mpsl, and x86 variants, ensuring it can infect a wide range of devices across multiple platforms.

The infection vector starts with compromised web servers that serve the malware to devices in countries such as Japan, Taiwan, Vietnam, and Mexico. Once the malicious script is executed, the malware fetches the appropriate Rust-based binary tailored to the victim’s system architecture. This allows the attacker to take full control of the device, turning it into a bot in the RustoBot network.

Tactics, Techniques, and Procedures (TTPs) of RustoBot

RustoBot’s implementation of advanced evasion techniques makes it a formidable threat. The malware’s configuration data is obfuscated using XOR encryption, which makes it difficult to analyze. It also employs dynamic resolution of system APIs through the Global Offset Table (GOT), complicating the process of reverse engineering.

Once installed, RustoBot communicates with its command-and-control (C2) server through encrypted DNS-over-HTTPS (DoH) traffic. This technique hides malicious communication among legitimate traffic, making it harder to detect and block. The botnet can send commands for a variety of malicious activities, such as distributed denial-of-service (DDoS) attacks.

The botnet’s ability to launch targeted DDoS attacks is particularly concerning. RustoBot’s C2 server can issue precise attack instructions, including attack methods (UDP, TCP, or raw IP flooding), target IP addresses, and the duration and size of the attack. This level of control allows attackers to cause significant disruption to services and websites, using the bandwidth of compromised routers to amplify the attacks.

RustoBot’s structure, coupled with its encrypted traffic, makes it a significant threat, not only for DDoS campaigns but also for data exfiltration or secondary attacks. As a result, organizations must remain vigilant, especially those utilizing vulnerable TOTOLINK and DrayTek devices, and apply necessary firmware patches to prevent exploitation.

What Undercode Says:

RustoBot represents a new level of sophistication in botnet development. The botnet’s use of the Rust programming language offers an innovative approach to malware creation. Unlike other languages commonly used in malware, Rust provides unique benefits such as memory safety, performance, and cross-platform support, which makes it harder for traditional security tools to detect and analyze malicious behavior.

The decision to exploit command injection vulnerabilities in commonly used consumer devices like TOTOLINK routers and DrayTek devices further underscores the growing trend of cybercriminals targeting IoT and edge devices. These devices are often less protected than traditional enterprise infrastructure, making them attractive targets for attackers looking to build powerful botnets.

RustoBot’s advanced evasion techniques also highlight the importance of multi-layered security measures. The use of encrypted communications (DoH) and XOR encryption shows that attackers are becoming more adept at avoiding traditional detection methods. Security professionals must adopt advanced threat detection tools that can analyze encrypted traffic and identify suspicious behavior within network devices.

Organizations should take immediate action by applying security patches for known vulnerabilities and implementing network segmentation to limit the impact of any potential breach. Additionally, endpoint monitoring and user education about device security are essential in minimizing the risk of exploitation. Given the increasing complexity of cyber threats, a proactive and comprehensive approach is necessary to defend against botnets like RustoBot.

RustoBot also highlights a larger trend of evolving cyber threats targeting the Internet of Things (IoT). As IoT devices continue to proliferate in homes and businesses, they represent an ever-growing surface area for cybercriminals to exploit. Cybersecurity professionals must continuously update their threat intelligence and defense strategies to stay ahead of these evolving threats.

Fact Checker Results:

RustoBot Botnet: The existence of RustoBot was confirmed by FortiGuard Labs, based on its detection of the malware targeting vulnerable routers and devices.
Exploited Vulnerabilities: The vulnerabilities listed (CVE-2022-26210, CVE-2022-26187, CVE-2024-12987) are recognized and documented in relevant security databases.
Rust Language: Rust is indeed gaining popularity for its efficiency and security features, making it a viable option for malware developers seeking to evade detection.