RondoDox Botnet Expands Scope With React2Shell Exploitation

RondoDox Botnet Expands Scope With React2Shell Exploitation reports that recent attacks are targeting Next.js servers and pose a significant threat of cryptomining, botnet payloads and other malicious activity to IoT networks and enterprises.

The threat actors behind the RondoDox botnet weaponise the React2Shell flaw as an initial access vector to deploy other payloads, including a Mirai-based botnet variant, with activity observed as part of a surge in RondoDox since its appearance last spring, according to CloudSEK and Rewterz.

CloudSEK noted that attacks began via the highly targeted React open source software flaw tracked as CVE-2025-55182, which also affects the Next.js platform, and that organisations running Next.js Server Actions face critical remote code execution exposure with active exploitation observed recently, according to the post.

Rewterz, in a blog post published on New Year’s Day, described the loader and health-check components and the Mirai and Morte IoT malware families, with about 90,300 exposed vulnerable servers worldwide, the majority in the US, followed by Germany, France and India. The loader module is said to aggressively remove competing malware, terminate non-whitelisted processes every 45 seconds, establish persistence via cron jobs, and prevent reinfection by rival actors, per Rewterz.

Mitigations include patching vulnerable Next.js and React Server Components, segmenting IoT devices, deploying a Web Application Firewall, restricting admin panel exposure, monitoring for suspicious binaries and cron jobs, blocking known C2 infrastructure, and running continuous vulnerability scans.