RondoDox Botnet Takes ‘Exploit Shotgun’ Approach

A newly identified botnet, dubbed RondoDox, takes a shotgun approach by packing over 50 exploits targeting unpatched routers, DVRs, NVRs, CCTV systems, servers and other network devices, according to Trend Micro. The campaign began activities in mid-2025 and was linked to the exploitation of CVE-2023-1389, a command injection flaw in the WAN interface of TP-Link Archer AX21 routers disclosed at a 2022 hacking contest.

In June, RondoDox was seen targeting CVE-2024-3721 and CVE-2024-12856, before expanding its target list to include more devices from over 30 vendors. It now targets a total of 56 vulnerabilities, including 18 that do not yet have a CVE identifier, with most being command injection bugs and some added to the US CISA KEV list.

CloudSek warned of a 230% surge in the botnet’s attacks since mid-2025, driven by weak credentials, unsanitised input and old CVEs, while the infected devices are abused for cryptocurrency mining, DDoS and lateral movement into enterprise networks. RondoDox’s operators were observed rotating infrastructure to evade detection, and the binaries have been seen distributed alongside Mirai and Morte payloads.