RondoDox Botnet Exploiting React2Shell Vulnerability

According to CloudSEK, the RondoDox botnet has been weaponising the React2Shell vulnerability to target Next.js servers, with the flaw tracked as CVE-2025-55182. Public disclosure of React2Shell was on 3 December 2025, and exploitation began within days of that date, with multiple threat actors subsequently observed targeting vulnerable instances.

The SecurityWeek article notes that over the past three weeks the RondoDox operators have concentrated on exploiting Next.js instances affected by React2Shell, conducting blind RCE testing between 8 and 16 December and starting to deploy malicious payloads on 13 December. Earlier activity shows first exploitation attempts in March 2025 and systematic vulnerability scanning from early April, followed by botnet deployment beginning in July.

The operators dropped a botnet support framework to purge other botnets and miners, installed a bot client, and added a miner and a Mirai variant on compromised systems, with payloads built for x86, x86_64, MIPS, ARM and PowerPC architectures.