Overview

We identified the staging server at 5[.]252[.]177[.]210:8090 through Hunt.io’s Attack Capture File Manager. Its open directory exposed a complete Windows infection chain: a PDF-themed shortcut, a drone-swarm research decoy, a batch downloader and an unsigned Rust implant that identifies itself as RUSTGate Client v2.0.

Hunt.io capture of the staging server, showing the malicious shortcut, drone-swarm decoy, batch downloader and RUSTGate implant.

The drone-themed document name and delivery chain suggest potential targeting of people working with unmanned systems or defence research. We have not identified a victim or independently confirmed the server’s targeting, so we treat this as a lure-based assessment rather than attribution. The implant itself is a remote-access trojan with built-in collection and exfiltration. It can execute arbitrary shell commands, move files in both directions and automatically search every logical drive for documents, archives, images, configuration files, logs and backups.

RUSTGate is not a conventional information stealer with dedicated browser-password, cookie, wallet or session-token extraction. Its native theft logic is file-oriented. However, its unrestricted command execution and controller-to-host transfer capability allow an operator to deploy additional tooling after compromise.

We later sent a small set of protocol-compatible requests from a synthetic identity to the known command-and-control server. The server accepted registration, but four polls returned no commands and delivered no payload.

From Shortcut to Scheduled Task

The chain begins with ABCD.pdf.lnk, which uses a Microsoft Edge icon to appear document-related. Its real target is rundll32.exe, configured to invoke shell32.dll!ShellExec_RunDLL, start a minimised command shell and retrieve test.bat from 5[.]252[.]177[.]210:8090.

The downloaded batch file then:

1. Retrieves Multicluster_Swarm_Drone_Network.pdf and opens it as a decoy.
2. Downloads NetworkDiagnostics.exe to C:\Windows\Temp and launches it.
3. Creates a scheduled task named NetworkDiagnostics, described as Network Diagnostics Service, which starts the implant immediately and repeats every 15 minutes.
4. Deletes the batch file from disk.

The decoy PDF supplied was not retrieved. The file name suggests a potential targeting relating to the defence sector.

The shortcut also preserves authoring metadata: the hostname server was used, a Public Pictures source path and a UUID node using VMware’s 00:50:56 organisationally unique identifier.

Inside RUSTGate

NetworkDiagnostics.exe is a stripped 64-bit Rust executable compiled on 12 May 2026. It is not conventionally packed and retains dependency and source-path evidence consistent with cross-compilation from Linux. Embedded product text names it RUSTGate CLIENT v2.0 and an Enterprise Remote Access Tool.

Its implemented capabilities are:

• Arbitrary command execution through cmd.exe /C, with stdout, stderr, exit status and execution time returned to the controller.
• Controller-to-host file writes, allowing an operator to place additional files at a chosen local path.
• Host-to-controller file transfer in 10 MiB chunks.
• Recursive discovery across all logical drives.
• Automatic collection every five minutes, enabled by default.
• Live changes to the command-polling interval.
• Basic host profiling using the client ID, hostname, username, Windows label, implant version and encryption state.
• Local logging to rustG.log and file-tracking state in upload_state.json.

The automatic collector targets 28 extensions, including Office documents, PDFs, text and configuration files, JSON, XML, images, compressed archives and backups. It records the path, size, modification time and MD5 of files it has processed, allowing it to avoid repeat uploads or notice changes.

The malware excludes many system, temporary, security-product, browser-cache, cloud-sync, virtual-machine, developer and gaming paths. This reduces noise and access errors while focusing collection on user and business data. It does not make collection narrow: eligible files elsewhere on attached drives remain in scope.

Client Identity and C2 Protocol

RUSTGate accepts a client identifier through --client-id or the CLIENT_ID environment variable. Without an override, it reads the hostname, generates a version-4 UUID from 128 random bits, formats the UUID as 32 lowercase hexadecimal characters and joins the values with a hyphen:

<hostname>-<uuid_v4_without_hyphens>

Unless the identifier is supplied or persisted outside the implant, each new generation can create a separate server-side record for the same host.

The default controller is hxxp://5[.]252[.]177[.]215:8080. RUSTGate uses HTTP/1.1 and JSON, with four routes:

Application messages are protected with AES-256-GCM using a hardcoded shared key. Each encrypted JSON envelope contains an encrypted flag, a Base64-encoded 12-byte nonce and Base64 ciphertext with the authentication tag appended. The outer transport remains plain HTTP, and possession of one sample is sufficient to recover the shared secret; this is message obfuscation and integrity protection, not strong controller authentication.

A Live but Idle Controller

Between 23:00 and 23:02 UTC on 31 August 2026, we sent bounded requests to the controller using a clearly synthetic client. The probe used only the implant’s known routes.

The server accepted the arbitrary client identifier without a cookie, bearer token, client certificate or other observed authentication. Its encrypted response decrypted to a successful registration object, validating the recovered key, nonce and authentication-tag layout, message envelope and registration schema.

Four subsequent polls returned encrypted HTTP 404 responses. Each decrypted to:

{
  "error": "No commands",
  "polling_interval": 5
}

No command, file, executable, script, URL or second-stage payload was delivered during the short observation window.

Response headers identified waitress as the server, while automatic route handling and permissive Access-Control-Allow-Origin: * responses were consistent with a Python Flask application behind the Waitress WSGI server. The server used a new nonce for every identical encrypted poll response and closed each HTTP connection.

Public Reporting and Attribution

The exact implant hash appears in a Triage sandbox report submitted on 12 June 2026 and in Hybrid Analysis. These records show that the sample has been publicly available, but neither establishes a reliable malware-family or actor attribution.

We found no indexed vendor report tying the RUSTGate name, its protocol and this execution chain to an established family. We therefore use the malware’s own internal name descriptively.

Both delivery and C2 addresses sit in 5[.]252[.]177[.]0/24, announced by AS39798 MivoCloud. Shared hosting proximity supports an infrastructure relationship between these two addresses, but not attribution to other tenants on the network.

Detection Priorities

Defenders should prioritise the chain rather than any single filename: a PDF-themed shortcut launching rundll32.exe, ShellExec_RunDLL spawning a minimised command shell, curl.exe writing a batch file or executable beneath C:\Windows\Temp, and PowerShell registering a scheduled task whose action also points into that directory.

On a suspected host, preserve upload_state.json before remediation. Its tracked paths may help establish which files the implant evaluated or transferred. Network telemetry for the two exact IP-and-port pairs and the four URI paths can identify staging, registration, polling, command results and exfiltration. Because the controller uses plain HTTP, preserved full-packet captures may also support retrospective decryption when complete envelopes are available.

IOCs

MITRE ATT&CK

These mappings describe behaviour recovered from the supplied artefacts. The malware chain itself was not executed.