RondoDox Botnet Swells Its Arsenal — 650% Jump in Enterprise-Focused Exploits

The RondoDox botnet has evolved from an IoT-focused threat into a multifaceted enterprise menace, with security researchers reporting October 30, 2025, as the shift date and Mayura Kathir noting the development on November 4, 2025. The v2 variant now features 75 exploitation vectors, expanding beyond DVRs and routers to target enterprise infrastructure such as WebLogic servers, QNAP NVRs, and Digiever surveillance systems, alongside older CVEs spanning a decade.

The discovery originated from automated exploitation attempts traced to IP 124.198.131[.]83 in New Zealand, with payloads downloaded from 74.194.191[.]52 and an explicit attacker signature embedded in User-Agent strings—bang2013@atomicmail[.]io. Infrastructure has diversified into multiple command servers hosted on compromised residential IPs, with C&C reach including 74.194.191[.]52, 38.59.219[.]27, 83.252.42.112 and 89.187.180[.]101, complicating attribution and takedown efforts.

FortiGuard Labs documented the original strain in September 2024, and the updated framework continues to leverage CWE-78 command injection and a range of architectures, from x86_64 to SPARC, to maximise reach and evasion. Organizations are urged to audit network segmentation, restrict outbound C&C connections, and prioritise patching for the listed CVEs aligned with their infrastructure.