React2Shell under attack: RondoDox Botnet spreads miners and malware

Securityaffairs.Co •Pierluigi Paganini • January 1, 2026

RondoDox botnet exploits the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable .js servers with malware and cryptominers. CloudSEK researchers warn that the RondoDox botnet is exploiting the critical React2Shell flaw (CVE-2025-55182) to drop malware and cryptominers on vulnerable .js servers. “CloudSEK’s report details a persistent nine-month RondoDoX botnet campaign targeting IoT devices and web applications. Recently, the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Targets React2Shell Flaw to Spread Malware The RondoDox botnet is exploiting the React2Shell vulnerability (CVE-2025-55182) to infect vulnerable .js servers with malware and cryptominers. This ongoing campaign has been active for nine months, primarily targeting IoT devices and web applications, as reported by CloudSEK researchers. 12 sources 81

Extracted Entities

React2Shell under attack: RondoDox Botnet spreads miners and malware

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

CVEs (1)

Malware (2)