CloudSEK uncovers Rust botnet targeting IoT and enterprise systems

CloudSEK researchers uncovered in October 2026 a Rust-based doorway botnet operating across a broad IoT and enterprise target footprint, exposing 41 gigabytes of operational data from two open directories. The Rust Doorway botnet compromises thousands of devices—including routers, IP cameras, DVRs, optical network terminals and enterprise Java servers—creating an unauthorized residential proxy fleet and intruding into developer and service-provider infrastructure across more than 75 countries.

The operation was traced to staging mirrors at 16.5.0[.]225 and 16.5.0[.]226, sharing identical archives and a six-address source IP pool on scan host X99-2, with 53,407 files in 9,370 folders catalogued between 19 September and 19 October 2026. The dataset describes a multi-protocol, automated exploitation approach using 59 run modules, augmented by default credential attacks and brute-force spraying, enabling widespread device compromise and proxy formation.

Technical attribution ties the infrastructure to a single developer collective that refers to itself as “the team”, with internal playbooks naming roles keeper, scout and watcher. The botnet runs a five-stage delivery sequence—probe, credential leak, login, validate, and clean—and can deploy architecture-specific loaders via multiple transport channels (netcat, wget, curl, TFTP, FTP, NFS, and formatted commands).

A 16-character hex signature bound to the target IP accompanies downloads to deter external access, and a post-delivery ICMP echo to 45.205.1[.]9 signals success before the next stage. Notable infection vectors include compromising 20 Jenkins servers, uploading malicious plugins to 16 Openfire servers, and breaching 29 DARKLANTERN router interfaces; MikroTik RouterOS devices supported 7,369 successful authentications, with internal proxies and 1,060 PPPoE subscriber records extracted.

The operation is described as a financially motivated effort to run and sell an unauthorised proxy network, supervised by an automated Watcher model using AI via OpenRouter to prioritise tasks.