RondoDox Botnet Unleashed: New Malware Uses ‘Exploit Shotgun’ to Target 50+ Router and IoT Flaws

Trend Micro has uncovered a rapidly expanding botnet campaign dubbed RondoDox, which targets a broad range of internet‑exposed devices from routers to CCTV systems and industrial networking gear, using over 50 distinct exploits across more than 30 vendors. According to Trend Micro’s Zero Day Initiative (ZDI) and Trend Research teams, the first intrusion attempt was detected on 15 June 2025, exploiting CVE-2023-1389 linked to TP-Link Archer AX21.

The campaign employs an “exploit shotgun” that tests dozens of known and unpatched vulnerabilities across an expanding attack surface, with multi‑architecture payloads enabling infections on ARM‑ and MIPS‑based devices and providing persistent control. Trend Micro notes that many flaws date back years, while others such as CVE-2025‑1829 and CVE-2025‑5504 have been added to the botnet’s arsenal, and that active exploitation has been observed globally since mid‑2025, now included in some vulnerability catalogs.

The operation has evolved into a loader‑as‑a‑service model, co‑packaging RondoDox with Mirai and Morte payloads under a shared delivery framework, complicating detection and remediation.