Campaign
Exploitation Wave
Malware Activity
RondoDox edge and web exploitation
Updated 31.12.2025 16:58
Case score 60
Score breakdown
- Total
- 60
- Lead score
- 56
- Support bonus
- +4 / 20
- Scoring support
- 2
- Context members
- 0
Top contributors
- Campaign Anchors the RondoDox operation and its exploit-shotgun, loader-as-a-service behavior. base
- Exploitation Wave Adds earlier edge-device exploitation and the CVE-2023-1389 router abuse that broadens the campaign. support
- Malware Activity Adds later Next.js malware deployment, React2Shell exploitation, and payload staging details. support
Case score 60
Members 3
Latest activity 31.12.2025 16:58
Active exploitation
Patch available
Active exploitation
Patch available
Members 3
First seen 10.10.2025 22:22
Last seen 31.12.2025 16:58
Updated 31.12.2025 16:58
Overview
RondoDox has moved from router-focused exploitation into a broader **exploit-shotgun** and loader-as-a-service operation against routers, DVRs, NVRs, CCTV systems, web servers, and **Next.js** servers. The activity includes confirmed abuse of **CVE-2023-1389** on **TP-Link Archer** routers and later **CVE-2025-55182 (React2Shell)** exploitation against exposed web infrastructure.
The payload chain now includes **Mirai/Morte**, a coinminer, and a loader/health-checker component, with persistence through **/etc/crontab**. Public reporting puts React2Shell exposure above **94,000 internet-exposed assets**, but compromise totals and the full reach of the botnet remain unquantified.
RondoDox is exploiting a wide set of public-facing flaws to turn routers, DVRs, NVRs, CCTV systems, web servers, and other network devices into botnet infrastructure. Trend Micro described the operation as an exploit-shotgun campaign spanning more than 30 vendors and more than 50 vulnerabilities. The distribution chain now includes a loader-as-a-service layer that bundles **RondoDox** with **Mirai/Morte** payloads.
On June 15, 2025, Trend Micro detected an intrusion attempt that used **CVE-2023-1389** against **TP-Link Archer** routers. That activity sits inside the wider edge-device wave that started in May and broadened across hard-to-patch internet-exposed infrastructure.
The operation later shifted into malware deployment against exposed **Next.js** servers by exploiting **CVE-2025-55182 (React2Shell)**. That chain dropped a coinminer, a botnet loader and health checker, and a **Mirai** variant, while enforcing persistence through **/etc/crontab** and removing competing malware. Public reporting put React2Shell exposure above **94,000 internet-exposed assets**, but available evidence does not quantify how many systems were compromised.
Defenders are being pushed toward patching **CVE-2023-1389** and **CVE-2025-55182**, plus isolating exposed devices and checking for botnet persistence signs. Available evidence still does not quantify the full reach of the botnet or the final compromise total.