“RondoDoX” Strikes Back: Exposed Logs Reveal Massive 9-Month Campaign Targeting Next.js and IoT

RondoDoX has resurfaced with a potent new arsenal, shifting its focus from routers to enterprise-grade web frameworks, according to a CloudSEK intelligence report that details a sprawling nine-month campaign. The attackers reportedly weaponised cutting-edge vulnerabilities to compromise systems ranging from smart home devices to servers running Next.js, with exposed command-and-control logs spanning March 2025 to December 2025.

The report notes the botnet’s rapid adoption of the React2Shell exploit targeting Next.js, marking an evolution beyond traditional payloads to weaponise the latest web framework flaws. Researchers describe RondoDoX as showing quick adaptation to trends, deploying web shells and cryptominers while exploiting Next.js vulnerabilities and continuing automated hourly exploitation attempts against IoT hardware.

The campaign includes widespread IoT device compromise, targeting internet-facing routers from brands such as D-Link, TP-Link, Netgear, Linksys and ASUS, alongside IP cameras, with the malware designed to run on x86, x86_64, MIPS, ARM and PowerPC architectures and to remove rival software to claim exclusive control. According to CloudSEK, the malware continuously scans /proc to enumerate running executables and kills non-whitelisted processes roughly every 45 seconds, a persistence tactic described as aggressive.