RondoDox Botnet Exploiting React2Shell Vulnerability

Back Feeds.Feedburner

RondoDox Botnet Exploiting React2Shell Vulnerability

Feeds.Feedburner •Ionut Arghire • January 2, 2026

Share: View original

In December, the botnet’s operators focused on weaponizing the flaw to compromise vulnerable .js servers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Targets React2Shell Flaw to Spread Malware The RondoDox botnet is exploiting the React2Shell vulnerability (CVE-2025-55182) to infect vulnerable .js servers with malware and cryptominers. This ongoing campaign has been active for nine months, primarily targeting IoT devices and web applications, as reported by CloudSEK researchers. 12 sources 81

Extracted Entities

Attack Types (1)

Malware (2)

React2Shell RondoDox