Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

RondoDox botnet mass exploitation of 56 n-day flaws

Malware Activity
First reported
Last updated
Happening score
H score 25
3 unique sources, 3 articles

Summary

Hide ▲

The RondoDox botnet is carrying out a mass n-day exploitation run against more than 50 vulnerabilities across over 30 vendors and internet-exposed devices. It uses a noisy “exploit shotgun” approach against routers, DVRs, NVRs, CCTV systems, web servers, and related network devices, and Trend Micro observed the campaign on June 15, 2025 exploiting CVE-2023-1389 on TP-Link Archer routers. The activity now also uses a loader-as-a-service setup that bundles Mirai/Morte payloads, making detection and remediation more urgent.

Related Happenings

Xlabs_v1 Mirai-derived ADB DDoS botnet

Malware Activity
H score22 First: 06.05.2026 23:21 Last: 06.05.2026 23:21 Sources 1

About this happening: The xlabs_v1 Mirai-derived botnet has been exposed as a DDoS tool that abuses Android Debug Bridge (ADB) on internet-facing devices, expanding risk to Android, rou...

Open Happening

China-nexus hijacked-device proxy network campaign

Campaign
H score43 First: 23.04.2026 15:28 Last: 23.04.2026 15:28 Sources 1

About this happening: NCSC-UK and international partners warned on 2026-04-23 that China-nexus hackers are using large-scale proxy networks built from hijacked consumer devices, including *...

Open Happening

D-Link DIR-823X command-injection RCE (CVE-2025-29635)

Vulnerability
H score40 First: 22.04.2026 23:04 Last: 22.04.2026 23:04 Sources 1

About this happening: CVE-2025-29635 is now being actively exploited on D-Link DIR-823X routers, turning a command-injection flaw into remote command execution and botnet enrollment...

Open Happening

Mirai-based CVE-2025-29635 D-Link DIR-823X botnet-enlistment campaign

Campaign
H score38 First: 22.04.2026 23:04 Last: 22.04.2026 23:04 Sources 1

About this happening: The Mirai-based malware campaign is actively exploiting CVE-2025-29635 against D-Link DIR-823X routers, turning vulnerable devices into botnet nodes. The activity matt...

Open Happening

TBK DVR command injection flaw actively exploited (CVE-2024-3721)

Vulnerability
H score1 First: 20.04.2026 16:01 Last: 20.04.2026 16:01 Sources 1

About this happening: The CVE-2024-3721 command injection flaw in TBK DVR systems is being actively exploited to gain access and install Nexcorium malware. Attackers abuse crafted request...

Open Happening

Timeline

  1. 09.10.2025 20:17 4 articles · 9mo ago

    RondoDox botnet mass exploitation of 56 n-day flaws

    Initial Disclosure

    The initial phase is a noisy, broad attack run against exposed devices using many exploits in parallel. It began in June 2025 and centers on quickly weaponized n-day vulnerabilities in DVRs, NVRs, CCTV systems, and related internet-facing gear.

    Show sources
    Open in new tab