RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers

RondoDox Botnet targets more than 50 vulnerabilities to infiltrate routers, CCTV systems, and web servers, using an exploit shotgun approach that spans over 30 vendors. The campaign began with an intrusion detected on 15 June 2025, reusing a command-injection vulnerability CVE-2023-1389 disclosed at Pwn2Own Toronto 2022, which affects the WAN interface of TP-Link Archer AX21 routers, and was later weaponised in Mirai campaigns.

Initially it focused on TBK DVRs (CVE-2024-3721) and Four-Faith routers (CVE-2024-12856), but has since expanded to 56 vulnerabilities—38 CVEs and 18 undocumented ones—covering issues such as command injection, path traversal, and memory corruption. Notable targets include D-Link, Netgear, Linksys, QNAP, Tenda, and ZyXEL, with the loader-as-a-service model co-packaging RondoDox with Mirai/Morte payloads to create a rotating infrastructure that evades detection.

The campaign also uses PoC commands like a shell one-liner to drop multi-architecture payloads, and defenders are advised to pursue rapid patching, asset management, and continuous monitoring, with IoCs such as suspicious process commands and specific loader and email indicators. According to Trend Vision One®, defenders can leverage built-in detections to flag these patterns and prevent exploitation, underscoring the urgency of proactive security practices.