RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers
The RondoDox campaign employs an "exploit shotgun" strategy, utilizing over 50 vulnerabilities across more than 30 vendors to compromise network devices. This highlights the critical need for rapid patching and continuous monitoring.
The RondoDox campaign employs an "exploit shotgun" strategy, utilizing over 50 vulnerabilities across more than 30 vendors to compromise network devices. This highlights the critical need for rapid patching and continuous monitoring.
The initial RondoDox intrusion was detected on Thu, Jun 15, 2025, involving a command-injection vulnerability disclosed at Pwn2Own Toronto 2022: CVE-2023-1389. This vulnerability targets the WAN interface of TP-Link Archer AX21 routers.
This vulnerability was quickly weaponized in Mirai campaigns post-disclosure, demonstrating how proof-of-concept code from security contests is rapidly integrated into botnet toolkits.
The RondoDox operators utilized PoC commands as follows:
#!/bin/sh curl -X POST http://TARGET/cgi-bin/apply.cgi -d 'action=ping&ping_ip=8.8.8.8;chmod 777 /tmp/sh;sh /tmp/sh'
These commands inject shells and deploy multi-architecture payloads. Trend Vision One® customers have been protected against CVE-2023-1389 since the patch release.
A Multivector "Exploit Shotgun" Approach
Initially targeting TBK DVRs (CVE-2024-3721) and Four-Faith routers (CVE-2024-12856), RondoDox has expanded to include 56 vulnerabilities—38 tracked CVEs and 18 undocumented ones. These involve command injection (CWE-78), path traversal (CWE-22), buffer overflow (CWE-120), authentication bypass (CWE-287), and memory corruption (CWE-119).
Notable vendors targeted include D-Link, Netgear, Linksys, QNAP, Tenda, and ZyXEL. Several newly observed CVEs are listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, emphasizing the need for prompt action.
The campaign employs a loader-as-a-service model, packaging RondoDox with Mirai/Morte payloads, creating a rotating infrastructure that complicates detection and remediation efforts.
RondoDox illustrates the shrinking window between public disclosure and mass exploitation. Even responsibly disclosed vulnerabilities quickly evolve into botnet threats.
The RondoDox campaign employs an "exploit shotgun" strategy, utilizing over 50 vulnerabilities across more than 30 vendors to compromise network devices.
Organizations managing internet-exposed routers, DVRs, NVRs, and other network edge devices must adopt a proactive security approach.
Regular vulnerability assessments and asset inventories are crucial for identifying outdated firmware and unpatched endpoints. Network segmentation can isolate critical systems, limiting lateral movement. Continuous monitoring and threat hunting are essential for early detection of RondoDox activity.
Below is a selection of indicators of compromise (IoCs) to assist defenders:
Indicator Type Value
Suspicious Process Cmd #!/bin/sh AND chmod 777
Malicious User-Agent bang2012@protonmail.com
Loader Domain Pattern rondo.
Common Email Addresses
bang2012@protonmail.com
makenoise@tutanota.de
Exploit Path Signatures /cgi-bin/apply.cgi
Trend Vision One™ Threat Insights customers can utilize built-in detections such as rule ZTH_Malware_RondoDox_Loader_A, which flags the combination of shell commands and loader patterns, and ZTH_Malware_RondoDox_Email for email-based indicators.
The RondoDox botnet emphasizes the necessity of rapid patch deployment, diligent asset management, and continuous monitoring.
Defenders must accelerate the patching process, maintain network segmentation, and hunt for early compromise signals to minimize the vulnerability window.
With proactive strategies and AI-powered platforms like Trend Vision One™, organizations can stay ahead of evolving multivector threats.
Based on reporting by GBHackers.