RUSTGate: A Drone-Swarm Lure Points to Potential Defence-Sector Targeting

Summary

A newly identified Rust-based Remote Access Trojan (RAT) named RUSTGate uses a drone-swarm research theme as a social engineering lure. The malware follows a multi-stage infection chain involving malicious LNK files, batch downloaders, and scheduled tasks to deploy the final implant. Once active, RUSTGate focuses on broad file theft and exfiltration over encrypted HTTP C2 communications.

Investigation

The investigation centered on a staging server discovered through Hunt.io that exposed the complete infection chain. Researchers interacted with the C2 protocol using synthetic requests and identified AES-256-GCM for message obfuscation along with a Python Flask-based backend. Analysis also revealed RUSTGate’s file-focused theft logic and automated data collection routines.

Mitigation

Defenders should prioritize monitoring for suspicious LNK files that use rundll32.exe to launch command shells. Strict controls on downloads to Temp directories and monitoring for unauthorized scheduled task creation are also important. Network segmentation and detection of outbound HTTP traffic to unusual IP addresses over non-standard ports can further disrupt C2 activity.

Response

If RUSTGate activity is detected, responders should immediately isolate the affected host and preserve the upload_state.json file to determine which data may have been compromised. Full-packet captures of traffic to identified C2 IPs should be collected for retrospective decryption. Systems should also be checked for the NetworkDiagnostics scheduled task and residual files in C:\Windows\Temp.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully established a foothold on the Windows workstation. To maintain control and receive further instructions, the RUSTGate malware must perform a “heartbeat” or “check-in” with its Command-and-Control (C2) server. The malware is programmed to reach out to the hardcoded IP 5.252.177.210 on port 8090. To differentiate its traffic from standard web browsing, it appends a specific URI path, such as /register, to the request. This simulation uses PowerShell to mimic this exact network handshake to validate if the SOC’s detection logic triggers on this specific C2 pattern.

• Regression Test Script:

  # RUSTGate C2 Check-in Simulation Script
  # This script mimics the network signature of RUSTGate to validate detection.
  
  $TargetIP = "5.252.177.210"
  $TargetPort = "8090"
  $TargetURI = "/register"
  
  $Url = "http://$($TargetIP):$($TargetPort)$($TargetURI)"
  
  Write-Host "[*] Simulating RUSTGate C2 communication to $Url" -ForegroundColor Cyan
  
  try {
      # Using Invoke-WebRequest to generate the specific URI and Port telemetry
      $Response = Invoke-WebRequest -Uri $Url -Method Get -ErrorAction SilentlyContinue
      Write-Host "[+] Request sent successfully (expected connection error if IP is inactive)." -ForegroundColor Green
  }
  catch {
      Write-Host "[!] Request completed (as expected for a non-existent C2 endpoint)." -ForegroundColor Yellow
  }

• Cleanup Commands:

  # No persistent artifacts are created by this simulation.
  # Simply confirming the process termination.
  Write-Host "[*] Simulation complete. No cleanup required." -ForegroundColor White