InfoSecBulletin Cybersecurity for mankind
The RondoDox botnet is using the serious React2Shell vulnerability (CVE-2025-55182) to infect unprotected Next.js servers with malware and cryptominers.
RondoDox, a large-scale botnet first reported by Fortinet in July 2025, targets various n-day vulnerabilities in global attacks. In November, VulnCheck discovered new variants of RondoDox that exploit the critical remote code execution vulnerability CVE-2025-24893 in the XWiki Platform.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
CloudSEK’s latest report reveals that RondoDox began scanning for vulnerable Next.js servers on December 8 and deployed botnet clients three days later.
React2Shell is an unauthenticated remote code execution vulnerability that can be exploited via a single HTTP request and affects all frameworks that implement the React Server Components (RSC) ‘Flight’ protocol, including Next.js.
Several threat actors used the flaw to attack multiple organizations. North Korean hackers exploited React2Shell to deploy new malware called EtherRAT.
As of December 30, the Shadowserver Foundation reports detecting over 94,000 internet-exposed assets vulnerable to React2Shell.
CloudSEK says that RondoDox has passed through three distinct operational phases this year:
Reconnaissance and vulnerability testing from March to April 2025
Automated web app exploitation from April to June 2025
Large-scale IoT botnet deployment from July to today
RondoDox has recently centered its attacks on the flaw, attempting over 40 exploits in six days in December.
The botnet conducts hourly attacks on Linksys, Wavlink, and other routers to add new devices.
After probing potentially vulnerable servers, CloudSEK says that RoundDox started to deploy payloads that included a coinminer (/nuts/poop), a botnet loader and health checker (/nuts/bolts), and a variant of Mirai (/nuts/x86).
The ‘bolts’ component eliminates rival botnet malware, ensures persistence through /etc/crontab, and terminates non-whitelisted processes every 45 seconds, according to researchers.
CloudSEK offers recommendations for companies to safeguard against RondoDox activities. These include auditing and patching Next.js Server Actions, isolating IoT devices on separate virtual LANs, and monitoring for suspicious processes.
