RondoDox Botnet: an 'Exploit Shotgun' for Edge Vulns

RondoDox Botnet is described as an “Exploit Shotgun” that targets dozens of known vulnerabilities in hard-to-patch edge devices worldwide, taking a hit-and-run, shotgun approach to exploitation. It began making the rounds in May, according to Trend Micro, and initially focused on one critical and one high-severity n-day vulnerability in DVRs and routers before expanding over the summer.

The botnet now doubles as a loader for Mirai and Morte IoT malware and can exploit any one of 56 vulnerabilities across routers, DVRs, NVRs, web servers, CCTV systems and other networking devices globally, 50 of which are known to be command injection flaws. All 56 vulnerabilities are publicly known, with 38 having CVE numbers. Dustin Childs of the Zero Day Initiative at Trend Micro characterised the approach as blasting everything at once rather than bespoke infections. The spread remains opportunistic and unfocused geographically, with experts suggesting the overall impact could be large. according to Trend Micro.