Cybersecurity researchers have disclosed particulars of a persistent nine-month-long marketing campaign that has focused Web of Issues (IoT) units and net functions to enroll them right into a botnet referred to as RondoDox.
As of December 2025, the exercise has been noticed leveraging the just lately disclosed React2Shell (CVE-2025-55182, CVSS rating: 10.0) flaw as an preliminary entry vector, CloudSEK mentioned in an evaluation.
React2Shell is the title assigned to a crucial security vulnerability in React Server Elements (RSC) and Subsequent.js that would permit unauthenticated attackers to realize distant code execution on inclined units.
Based on statistics from the Shadowserver Basis, there are about 90,300 situations that stay inclined to the vulnerability as of December 31, 2025, out of which 68,400 situations are positioned within the U.S., adopted by Germany (4,300), France (2,800), and India (1,500).
RondoDox, which emerged in early 2025, has broadened its scale by including new N-day security vulnerabilities to its arsenal, together with CVE-2023-1389 and CVE-2025-24893. It is price noting that the abuse of React2Shell to unfold the botnet was beforehand highlighted by Darktrace, Kaspersky, and VulnCheck.
The RondoDox botnet marketing campaign is assessed to have gone by means of three distinct phases previous to the exploitation of CVE-2025-55182 –
- March – April 2025 – Preliminary reconnaissance and guide vulnerability scanning
- April – June 2025 – Each day mass vulnerability probing of net functions like WordPress, Drupal, and Struts2, and IoT units like Wavlink routers
- July – early December 2025 – Hourly automated deployment on a large-scale
Within the assaults detected in December 2025, the menace actors are mentioned to have initiated scans to establish weak Subsequent.js servers, adopted by makes an attempt to drop cryptocurrency miners (“/nuts/poop”), a botnet loader and well being checker (“/nuts/bolts”), and a Mirai botnet variant (“/nuts/x86”) on contaminated units.
“/nuts/bolts” is designed to terminate competing malware and coin miners earlier than downloading the principle bot binary from its command-and-control (C2) server. One variant of the device has been discovered to take away recognized botnets, Docker-based payloads, artifacts left from prior campaigns, and related cron jobs, whereas additionally establishing persistence utilizing “/and so on/crontab.”
“It constantly scans /proc to enumerate operating executables and kills non-whitelisted processes each ~45 seconds, successfully stopping reinfection by rival actors,” CloudSEK mentioned.
To mitigate the chance posed by this menace, organizations are suggested to replace Subsequent.js to a patched model as quickly as attainable, section all IoT units into devoted VLANs, deploy Internet Software Firewalls (WAFs), monitor for suspicious course of execution, and block recognized C2 infrastructure.
