RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

RondoDox is a botnet campaign disclosed by researchers as a persistent nine‑month operation that targeted IoT devices and web applications to join a botnet, using the React2Shell flaw (CVE-2025-55182) as an initial access vector. As of December 2025, Shadowserver Foundation statistics show about 90,300 vulnerable instances remain, with 68,400 in the U.S., followed by Germany, France and India, and the activity has broadened to include new vulnerabilities such as CVE-2023-1389 and CVE-2025-24893.

The campaign is described as having three phases prior to exploiting React2Shell: March–April 2025 for reconnaissance and manual scanning, April–June 2025 for daily mass vulnerability probing of WordPress, Drupal and Struts2, and IoT devices like Wavlink routers, and July–early December 2025 for hourly automated deployment on a large scale.

In December 2025, the threat actors reportedly scanned for vulnerable Next.js servers and attempted to drop cryptocurrency miners, a botnet loader and health checker, and a Mirai variant on infected devices, with a variant of the loader terminating rival malware and setting up persistence via /etc/crontab.

CloudSEK notes that one tool, /nuts/bolts, is designed to terminate competing malware before downloading the main bot binary from its C2, while another component uses a specific path to drop payloads and perform persistence. Mitigation guidance includes updating Next.js to a patched version, segmenting IoT devices into dedicated VLANs, deploying Web Application Firewalls, monitoring for suspicious process execution, and blocking known C2 infrastructure.