Loading story…
The RondoDox botnet has been actively exploiting a critical vulnerability in unpatched XWiki servers, identified as CVE-2025-24893, which allows arbitrary remote code execution via the /bin/get/Main/SolrSearch endpoint. This flaw, rated with a CVSS score of 9.8, was patched in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1, but many instances remain exposed. Since late October 2025, there has been a significant increase in exploitation attempts, with attackers leveraging the vulnerability to deploy cryptocurrency miners, establish reverse shells, and conscript devices into the RondoDox botnet for distributed denial-of-service (DDoS) attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-24893 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply mitigations by November 20.
VulnCheck reports that multiple independent threat actors, including RondoDox, are targeting this vulnerability using custom tooling, bespoke scanners, and well-documented payload servers. The first RondoDox exploit was observed on November 3, 2025, and activity has continued to escalate, with clear attribution based on unique HTTP User-Agent strings and payload naming conventions. The surge in attacks underscores the urgent need for organizations to patch affected XWiki instances and implement early detection measures to prevent compromise and further botnet expansion.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
By mid-November 2025, public reporting tied CVE-2025-24893 exploitation to RondoDox, cryptominer operators, and other attackers using public exploit methods such as Nuclei templates. The reporting highlighted active abuse of unpatched XWiki servers and published IoCs for defenders.
A second major spike in attacks against vulnerable XWiki servers was observed on November 11. Campaigns included botnet enrollment, cryptocurrency miner deployment, and reverse shell attempts.
Researchers observed a notable increase in scanning and exploitation attempts targeting CVE-2025-24893 on November 7. The activity indicated broader adoption of the flaw by multiple malicious actors.
VulnCheck observed RondoDox botnet activity targeting vulnerable XWiki instances starting on November 3. The botnet used crafted requests to inject Groovy code and pull compromised servers into its DDoS infrastructure.
CISA marked the XWiki flaw as actively exploited and added it to the Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies were ordered to remediate by November 20, 2025.
The vulnerability was patched in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1. These releases addressed the critical eval injection bug enabling remote code execution.
Multiple sources say exploitation of the XWiki vulnerability began no later than March 2025. Different attackers used the flaw for arbitrary code execution, including reverse shells and malware deployment.
Reports describe CVE-2025-24893, an eval injection remote code execution flaw in XWiki, as having been left unpatched since February 2025. The bug affects XWiki versions prior to the later fixed releases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting a critical unauthenticated remote template-injection vulnerability in *XWiki* (CVE-2025-24893), enabling arbitrary remote code execution via the `/bin/get/Main/SolrSearch` endpoint. VulnCheck and other security researchers observed a two-stage attack chain: the first stage downloads a payload to the target system, and the second stage executes it, ultimately deploying a cryptocurrency miner. Exploit attempts have been traced to attackers geolocated in Vietnam, and the vulnerability has been weaponized in real-world attacks since at least March 2025, according to reports from VulnCheck, CrowdSec, and Cyble. Despite the active exploitation, CVE-2025-24893 was not initially included in the CISA Known Exploited Vulnerabilities (KEV) catalog, highlighting a lag between real-world attacks and official recognition. Technical details reveal that attackers use a crafted request to inject Groovy code, which executes a `wget` command to download a malicious file to `/tmp/11909`. Security teams are advised to monitor for exploit attempts targeting the vulnerable endpoint and to apply available patches to mitigate the risk of compromise and subsequent cryptomining activity.
Jun 29, 2026
The RondoDox botnet has emerged as a significant threat, actively targeting a wide array of internet-exposed infrastructure by exploiting over 50 known vulnerabilities, many of which were first disclosed during Pwn2Own hacking competitions. Security researchers from Trend Micro and FortiGuard Labs have observed the botnet leveraging an 'exploit shotgun' approach, simultaneously deploying numerous exploits to maximize infection rates across diverse device types. The campaign has been active globally since at least June 2025, with attacks focusing on routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and other network devices from more than 30 vendors. Notably, the botnet exploits both recent and older vulnerabilities, including CVE-2023-1389 in the TP-Link Archer AX21 Wi-Fi router, which was originally demonstrated at Pwn2Own Toronto 2022 and previously targeted by Mirai. The list of exploited vulnerabilities includes CVE-2024-3721, CVE-2024-12856, and many others affecting brands such as Digiever, QNAP, LB-LINK, TRENDnet, D-Link, TBK, Four-Faith, Netgear, AVTECH, TOTOLINK, Tenda, Meteobridge, Edimax, and Linksys. Many of these vulnerabilities are now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for organizations to patch affected systems. Devices that have reached end-of-life are particularly at risk, as they are less likely to receive security updates, making them attractive targets for the botnet operators. The campaign exposes organizations to risks including data exfiltration, persistent network compromise, and operational disruption, especially for those with internet-facing infrastructure. Security experts recommend prioritizing the patching of all listed vulnerabilities, conducting regular vulnerability assessments, segmenting networks to limit lateral movement, and continuously monitoring for anomalous device activity. Trend Micro has indicated that its solutions provide protection against the vulnerabilities exploited by RondoDox, offering mitigation while patching is underway. The rapid weaponization of vulnerabilities demonstrated at Pwn2Own highlights the need for organizations to monitor disclosures from such competitions and act swiftly to secure their environments. The RondoDox botnet’s ability to quickly expand its arsenal of exploits demonstrates a high level of adaptability and threat actor sophistication. The campaign’s global reach and the diversity of targeted devices suggest that organizations across multiple sectors are at risk. The use of mass n-day exploitation, rather than relying solely on zero-day vulnerabilities, allows the botnet to compromise a large number of devices that may not be promptly patched. Security researchers emphasize the importance of defense-in-depth strategies to mitigate the impact of such widespread exploitation campaigns. The ongoing activity of RondoDox serves as a stark reminder of the persistent threat posed by botnets leveraging known vulnerabilities in widely deployed network devices.
Jun 29, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026