New Research: RondoDox v2, a 650% Expansion in Exploits

Reddit •/u/mario_candela • November 4, 2025

Through our honeypot ( ), I’ve identified a major evolution of the RondoDox botnet, first reported by FortiGuard Labs in 2024. The newly discovered RondoDox v2 shows a dramatic leap in sophistication and scale: 🔺 +650% increase in exploit vectors (75+ CVEs observed) 🔺 New C&C infrastructure on compromised residential IPs 🔺 16 architecture variants 🔺 Open attacker signature: bang2013@atomicmail[.]io 🔺 Targets expanded from DVRs and routers to enterprise systems The full report includes: - In-depth technical analysis (dropper, ELF binaries, XOR decoding) - Full IOC list - YARA and Snort/Suricata detection rules - Discovery timeline and attribution insights submitted by /u/mario_candela [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox v2 Botnet Expands Exploits by 650%, Targets Enterprise Systems RondoDox v2, an evolved IoT botnet, has shown a 650% increase in exploit vectors, now encompassing over 75 CVEs. The botnet has transitioned from targeting consumer devices like DVRs and routers to enterprise systems, utilizing new command and control infrastructure on compromised residential IPs. It supports 16 architecture variants and employs XOR obfuscation for its operations. 2 sources 38

New Research: RondoDox v2, a 650% Expansion in Exploits

The full story

Extracted Entities

Attack Types (1)

Malware (1)