RondoDox v2: When an IoT Botnet Goes Enterprise

Reddit •/u/mario_candela • November 3, 2025

I've just published my analysis on RondoDox v2, and the numbers speak for themselves: +650% exploit vectors compared to v1 documented by FortiGuard Labs. Key Findings: - 15+ exploitation vectors (from 2 CVEs to enterprise-grade attacks) - C&C on compromised residential IP (multiple AWS EC2) - 16 architectures supported with XOR obfuscation (key: 0x21) - Open attribution: [ bang2013@atomicmail.io ](mailto: [email protected] ) 🚨 What concerns me: The jump from consumer DVR/routers to enterprise targets demonstrates an aggressive expansion strategy. We're no longer talking a "simple" DDoS botnet. 🟢 IOCs and detection rules: YARA, Snort/Suricata and complete IOC list available in the full post. submitted by /u/mario_candela [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RondoDox v2 Botnet Expands Exploits by 650%, Targets Enterprise Systems RondoDox v2, an evolved IoT botnet, has shown a 650% increase in exploit vectors, now encompassing over 75 CVEs. The botnet has transitioned from targeting consumer devices like DVRs and routers to enterprise systems, utilizing new command and control infrastructure on compromised residential IPs. It supports 16 architecture variants and employs XOR obfuscation for its operations. 2 sources 38

Extracted Entities

RondoDox v2: When an IoT Botnet Goes Enterprise

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Domains (1)

Malware (1)