Researchers Warn RondoDox Botnet is Weaponizing Over 50 Flaws Across 30+ Vendors

RondoDox malware campaigns have broadened to weaponise more than 50 vulnerabilities across over 30 vendors, extending their reach to internet‑exposed routers, DVRs, NVRs, CCTV systems, web servers and other networked devices, according to Trend Micro. The activity was described as an “exploit shotgun” approach, and an intrusion attempt was detected on 15 June 2025 when attackers exploited CVE-2023-1389 in TP‑Link Archer routers.

RondoDox was first documented by Fortinet FortiGuard Labs in July 2025, detailing attacks targeting TBK DVRs and Four‑Faith routers to enlist devices into a botnet used for DDoS attacks via HTTP, UDP and TCP.

Trend Micro noted that the botnet’s expanded arsenal includes nearly five dozen flaws, 18 of which do not yet have a CVE identifier, with vendors including D‑Link, TVT, LILIN, Fiberhome, Linksys, BYTEVALUE, ASMAX, Brickcom, IQrouter, Ricon, Nexxt, NETGEAR, Apache, TBK, TOTOLINK, Meteobridge, Digiever, Edimax, QNAP, GNU, Dasan, Tenda, LB‑LINK, AVTECH, Zyxel, Hytec Inter, Belkin, Billion and Cisco.

Late last month, CloudSEK revealed details of a large loader‑as‑a‑Service operation distributing RondoDox, Mirai and Morte payloads by weaponising weak credentials and old CVEs. The campaign is evolving from single‑device opportunism into a multivector loader operation, according to the report.