MalwarePublished 22 Dec 2025

I caught a Rust DDoS botnet on my honeypot, reverse engineered it, and now I'm monitoring its targets in real-time

Source Reddit NetSec

Description

A newly discovered Rust-based DDoS botnet exploits exposed Docker APIs on port 2375 to recruit compromised hosts. The malware uses asynchronous Rust libraries and obfuscation techniques to evade detection, with no antivirus engines initially detecting it. Its command-and-control (C2) protocol is weakly secured, lacking encryption and using predictable nonces and hardcoded credentials. The botnet infrastructure is centralized on a single server, which serves both malware distribution and C2 functions. The researcher developed a honeypot that impersonates infected bots to monitor ongoing DDoS targets in real time. This threat highlights the risks of exposed Docker APIs and the challenges traditional detection tools face with modern Rust-based malware. European organizations running Docker with exposed APIs are at risk of compromise and subsequent participation in DDoS attacks. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and deployment of custom detection rules based on provided YARA and Snort signatures. Countries with high Docker adoption and significant internet infrastructure are most likely affected. The threat is assessed as medium severity due to moderate impact and exploitation complexity but notable evasion capabilities.

Impact

European organizations running Docker environments with exposed APIs are at risk of unauthorized container control, leading to their infrastructure being co-opted into DDoS attacks. This can result in degraded service availability, reputational damage, and potential collateral damage if critical services are disrupted. The stealthy nature of the Rust-based malware and its evasion of traditional antivirus detection complicate timely identification and response. Additionally, the centralized C2 infrastructure means takedown efforts could be effective but also that attackers could pivot to more resilient architectures. Organizations involved in cloud services, hosting, and internet infrastructure are particularly vulnerable, as compromised Docker hosts can amplify attack traffic. The threat also raises concerns about supply chain risks if Docker images or environments are shared across European entities. Overall, the impact includes reduced service availability, increased incident response costs, and potential regulatory scrutiny under European cybersecurity frameworks.

Defensive guidance

1. Immediately audit and restrict access to Docker APIs, especially port 2375, ensuring it is not exposed to untrusted networks or the internet. 2. Implement strong authentication and TLS encryption for Docker API access to prevent unauthorized exploitation. 3. Deploy network segmentation to isolate container management interfaces from general network traffic. 4. Utilize the provided YARA and Snort detection rules to identify and block this specific Rust-based botnet activity. 5. Monitor network traffic for unusual outbound connections to the identified C2 IP (196.251.100.116) and ports (80, 8080). 6. Conduct regular vulnerability assessments and penetration tests focusing on container orchestration security. 7. Educate DevOps and security teams about the risks of exposed Docker APIs and the evolving threat landscape involving Rust malware. 8. Consider deploying runtime container security solutions capable of detecting anomalous container behavior and network activity. 9. Collaborate with ISPs and CERTs to share IoCs and coordinate response efforts. 10. Maintain updated incident response plans that include scenarios involving container exploitation and botnet participation.

Summary

This threat involves a novel distributed denial-of-service (DDoS) botnet written in Rust, identified through a honeypot named Beelzebub. The botnet targets systems with exposed Docker APIs on the default port 2375, exploiting the lack of authentication to gain control over Docker containers and recruit them into the botnet. The malware leverages Rust's Tokio library for asynchronous networking, bincode for a custom command-and-control (C2) protocol, and obfstr for string obfuscation, which collectively hinder detection by traditional antivirus engines. The C2 protocol is notably weak: it transmits data without encryption, uses a predictable nonce, and authenticates with a hardcoded username "client_user," making it vulnerable to interception or disruption. The entire botnet infrastructure is centralized on a single IP address (196.251.100.116), which hosts both the malware distribution server on port 80 and the C2 server on port 8080, representing a single point of failure. The researcher reverse engineered the malware, decoded the C2 protocol, and created a honeypot that mimics an infected bot to monitor real-time DDoS attack targets. The post includes detailed attack chain analysis, sandbox setup for dynamic analysis, IoCs, and detection rules (YARA and Snort) to aid defenders. The botnet's stealthiness and exploitation of exposed Docker APIs underscore the importance of securing container management interfaces and updating detection capabilities to handle Rust-based malware.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Dec 2025, 15:58 UTC

Technical details

References

Community reviews

Related threats