React2Shell under attack: RondoDox Botnet spreads miners and malware

React2Shell under attack: RondoDox Botnet spreads miners and malware, with CloudSEK researchers warning that the botnet is exploiting the critical React2Shell flaw (CVE-2025-55182) to drop malware and cryptominers on vulnerable Next.js servers. The campaign, active since mid-2024, has evolved into a nine-month operation targeting IoT devices and web applications, and recently shifted to weaponising the Next.js vulnerability, deploying payloads such as “React2Shell” and cryptominers.

FortiGuard Labs first spotted the botnet exploiting CVE-2024-3721 and CVE-2024-12856 in July, and Trend Micro later reported that RondoDox exploits 56 known flaws across more than 30 device types, including DVRs, NVRs, CCTV systems and web servers, operating globally since June.

In the current wave, the group has launched over 40 exploit attempts in six days and now conducts hourly IoT exploitation waves targeting routers from Linksys and Wavlink, delivering a cryptominer, a botnet loader and health checker, and a Mirai variant. Guidance calls for urgent audits of Next.js apps with patching or disablement, hardening IoT devices, WAF protections, and zero-trust measures for admin interfaces.