RondoDox Botnet Grows, Exploiting 174 Vulnerabilities via Residential IPs

The RondoDox botnet has rapidly expanded, now exploiting 174 vulnerabilities using compromised residential IP addresses. First detected in May 2025, it has generated significant traffic in security honeypots, indicating its active presence. The botnet operates similarly to Mirai, leveraging weak security controls in consumer devices, which are often shipped without adequate patches. This widespread exploitation increases the global attack surface, affecting numerous devices and networks. The botnet's automated capabilities allow it to chain vulnerabilities effectively, raising concerns among security professionals. Vendors are urged to improve security practices to mitigate risks associated with such automated threats. Current status indicates ongoing activity and potential for further growth as new vulnerabilities are discovered.

Key Points: • RondoDox botnet exploits 174 vulnerabilities using residential IP infrastructure. • First detected in May 2025, it has shown significant growth and activity. • Weak security controls in consumer devices contribute to the botnet's expansion.