RondoDoX Botnet Weaponizing a Critical React2Shell Vulnerability to Deploy Malware

Cybersecuritynews •Tushar Subhra Dutta • January 2, 2026

A sophisticated threat group has intensified its campaign against organizations by leveraging the latest vulnerabilities in web applications and Internet of Things (IoT) devices. The RondoDoX botnet, tracked through exposed command-and-control logs spanning nine months from March to December 2025, demonstrates a relentless approach to compromising enterprise infrastructure. The malware operates through a multi-stage infection […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox Botnet Targets React2Shell Flaw to Spread Malware The RondoDox botnet is exploiting the React2Shell vulnerability (CVE-2025-55182) to infect vulnerable .js servers with malware and cryptominers. This ongoing campaign has been active for nine months, primarily targeting IoT devices and web applications, as reported by CloudSEK researchers. 12 sources 81

RondoDoX Botnet Weaponizing a Critical React2Shell Vulnerability to Deploy Malware

The full story

Extracted Entities

Attack Types (2)

Malware (2)