Back Cybersecuritynews

RondoDox Botnet Expands to 174 Exploits, Leveraging Residential IP Infrastructure at Scale

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A newly tracked botnet called RondoDox has quietly built itself into one of the more concerning threats observed in recent months, combining an unusually large collection of exploits with a calculated use of residential internet infrastructure. First detected in May 2025, the botnet began generating high volumes of traffic in security honeypots and has since […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Grows, Exploiting 174 Vulnerabilities via Residential IPs The RondoDox botnet has rapidly expanded, now exploiting 174 vulnerabilities using compromised residential IP addresses. First detected in May 2025, it has generated significant traffic in security honeypots, indicating its active presence. The botnet operates similarly to Mirai, leveraging weak security controls in consumer devices, which are often shipped without adequate patches. This widespread exploitation increases the global attack surface, affecting numerous devices and networks. The botnet's automated capabilities allow it to chain vulnerabilities effectively, raising concerns among security professionals. Vendors are urged to improve security practices to mitigate risks associated with such automated threats. Current status indicates ongoing activity and potential for further growth as new vulnerabilities are discovered. 4 sources 67

RondoDox Botnet Expands to 174 Exploits, Leveraging Residential IP Infrastructure at Scale

The full story

Extracted Entities

Attack Types (1)

Malware (1)