RondoDox Botnet targets 56 flaws across 30+ device types worldwide

Trend Micro researchers report that the RondoDox botnet is exploiting 56 known flaws across more than 30 device types, including DVRs, NVRs, CCTV systems and web servers, and has been active globally since June. The campaign is described as an “exploit shotgun” approach, firing multiple exploits to see which succeed.

In July, FortiGuard Labs first spotted RondoDox exploiting CVE-2024-3721 and CVE-2024-12856, with the botnet having been active since 2024 and using custom libraries to mimic gaming or VPN traffic in order to evade detection. According to Trend Micro, the group was first seen by them on June 15, 2025, exploiting CVE-2023-1389 in TP-Link Archer AX21 routers, a flaw that was showcased at Pwn2Own 2023 and remains popular with botnets.

The report notes that RondoDox now exploits multiple CVEs, including CVE-2024-3721 and CVE-2024-12856, evolving into a multivector loader targeting diverse devices, with a broad roster of affected vendors and product types. Moving forward, defenders are urged to adopt a proactive security posture, including regular vulnerability assessments, network segmentation, restricted internet exposure, and continuous monitoring for compromise.