Back Gbhackers

RondoDox Botnet Scales Up, Exploiting 174 Vulnerabilities via Residential IPs

Gbhackers •Mayura Kathir • March 16, 2026

RondoDox is a Mirai‑style botnet that has quickly evolved into a highly automated exploitation engine, chaining 174 vulnerabilities with large‑scale use of compromised residential IP infrastructure. This explosive growth widens the global attack surface, especially as many vendors still ship devices with weak security controls and poor patch practices. research has already highlighted systemic […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Grows, Exploiting 174 Vulnerabilities via Residential IPs The RondoDox botnet has rapidly expanded, now exploiting 174 vulnerabilities using compromised residential IP addresses. First detected in May 2025, it has generated significant traffic in security honeypots, indicating its active presence. The botnet operates similarly to Mirai, leveraging weak security controls in consumer devices, which are often shipped without adequate patches. This widespread exploitation increases the global attack surface, affecting numerous devices and networks. The botnet's automated capabilities allow it to chain vulnerabilities effectively, raising concerns among security professionals. Vendors are urged to improve security practices to mitigate risks associated with such automated threats. Current status indicates ongoing activity and potential for further growth as new vulnerabilities are discovered. 4 sources 67

RondoDox Botnet Scales Up, Exploiting 174 Vulnerabilities via Residential IPs

The full story

Extracted Entities

Attack Types (1)

Malware (2)