RondoDox Botnet Broadens Exploitation to 174 Vulnerabilities

RondoDox has expanded into a large-scale botnet campaign that targets 174 vulnerabilities across a wide range of internet-exposed devices, with researchers observing up to 15,000 daily exploitation attempts. Reporting based on Bitsight telemetry says the botnet, active since 2025 and built on a Mirai code base, is more focused than typical Mirai-derived operations: it is geared toward denial-of-service activity and supports 18 architectures, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped 148 exploits to CVEs, identified 15 public PoCs without CVEs, and found 11 exploits with no public PoC, indicating active exploit collection and rapid weaponization of newly disclosed flaws.

The campaign has evolved from earlier exploitation of TP-Link Archer AX21 flaw CVE-2023-1389 and later abuse of CVE-2024-3721, CVE-2024-12856, and the React2Shell issue CVE-2025-55182 affecting Next.js servers. Researchers also reported that the operators use residential IP infrastructure and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit CVE-2025-62593 before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.