RondoDox Botnet Exploits Critical React2Shell Flaw to Compromise IoT Devices and Web Servers — What You Must Know

Security researchers have revealed that the RondoDox botnet, a rapidly evolving and highly automated malware network, is now actively exploiting a critical remote code execution (RCE) vulnerability known as React2Shell (CVE-2025-55182) to infiltrate vulnerable web applications and IoT devices around the world. This campaign has been ongoing for months — taking advantage of unpatched servers and embedded systems to install botnet components, deploy cryptominers, and expand the botnet’s reach across diverse environments.

The RondoDox botnet’s aggressive exploitation of React2Shell — alongside a growing arsenal of other critical vulnerabilities — underscores the severity of the threat and highlights the urgent need for organizations to patch affected systems, strengthen network defenses, and monitor for signs of compromise. Below is an in-depth, SEO-optimized, 1500-word analysis of the RondoDox campaign, its tactics, impact, and mitigation recommendations.

What Is the React2Shell Vulnerability?

React2Shell (CVE-2025-55182) is a critical remote code execution (RCE) flaw affecting frameworks that implement the React Server Components (RSC) “Flight” protocol, including Next.js — a widely used React-based web application framework. This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable servers with a single crafted HTTP request — an exceptionally dangerous scenario for internet-facing systems.

Importantly, React2Shell is not limited to a specific version of Next.js; it impacts any implementation of the RSC Flight protocol that fails to validate malicious input properly, including Next.js releases up through vulnerable canary and stable builds.

Once exploited, RondoDox uses the flaw to gain initial access to servers, drop malware loaders, and execute multiple payloads — making the flaw an attractive vector for botnet operators and other threat actors.

Who Is at Risk?

React2Shell’s exploitation surface spans both enterprise web applications and IoT devices embedding Next.js or RSC implementations. According to the Shadowserver Foundation, over 90,000 internet-exposed assets remain vulnerable to the flaw, with large concentrations in the United States (≈68,400), Germany, France, India, and other regions.

Affected environments include:

• Public web servers running Next.js applications
• IoT and edge devices that expose RSC-based interfaces
• Network-attached storage (NAS) and other embedded systems with web components
• Consumer routers and CCTV/network video recorders indirectly reachable via linked applications

Because the exploit requires no authentication, any exposed service listening on default ports with RSC enabled is at immediate risk if unpatched.

How RondoDox Works: Campaign Anatomy

The RondoDox botnet is a modular and rapidly evolving threat, capable of adjusting its exploitation targets and payloads as new vulnerabilities emerge. Its current use of React2Shell is only the latest phase in its broader operational toolkit.

Multi-Phase Campaign

According to researchers, the botnet’s operations have unfolded in distinct phases throughout 2025:

1. Reconnaissance & Scanning (March–April 2025):
   RondoDox began by mapping internet-facing systems and testing their exposure to known vulnerabilities.
2. Mass Exploitation (April–June 2025):
   The botnet shifted to automated probing of a variety of web apps (e.g., WordPress, Drupal) and IoT systems.
3. IoT Botnet Deployment (July–December 2025):
   Automated waves of exploitation targeted routers, DVRs, IoT gateways, and increasingly Next.js servers via new high-severity flaws like React2Shell.

Payloads and Capabilities

Once React2Shell or another vulnerability is successfully exploited, RondoDox deploys multiple malicious components to the compromised host. These typically include:

Botnet Loader (“/nuts/bolts”)

• Acts as the central loader and health checker for the botnet client.
• Modifies system scheduling (e.g., /etc/crontab) for persistence.
• Implements process whitelisting, killing non-botnet processes regularly to prevent other malware from co-existing and to maintain exclusive control.

Cryptominer (“/nuts/poop”)

• Deployed to hijack system resources for unauthorized cryptocurrency mining (typically Monero), generating illegal revenue for the operators while degrading host performance.

Mirai Variant (“/nuts/x86”)

• A variant of the infamous Mirai botnet family that continues scanning for additional vulnerabilities, propagating laterally, and broadening the compromised device pool.

These payloads work in concert to grow the botnet, maintain persistence, and exploit connected networks and devices.

Broad Targeting: Beyond Web Servers

While React2Shell provides a critical new vector, RondoDox’s threat model is far broader and not limited to Next.js applications. It has been observed targeting a wide array of devices and vulnerabilities, reflecting an “exploit shotgun” strategy:

• Command injection and RCE CVEs in routers (TP-Link, D-Link, Netgear, etc.)
• Legacy vulnerabilities in DVRs, NVRs, CCTV and embedded cameras
• IoT appliances with unpatched services or outdated firmware
• Previous critical flaws like CVE-2025-24893 in the XWiki Platform that enable remote code execution on content management systems

This broad, multi-vendor targeting illustrates that RondoDox is not a single-purpose malware but a flexible, automated framework adapted to exploit whatever entry points exist on the internet.

Real-World Impact and Scale

Because RondoDox aggressively scans the internet for exploitable systems, its impact spans public and private sector environments. Among the most significant concerns are:

Widespread Asset Exposure

Thousands of internet-facing assets remain unpatched, giving RondoDox an extensive field of opportunity. Over 94,000 vulnerable instances have been identified, and exploitation attempts have been reported on a near-hourly basis for some targets.

Enterprise and Consumer Devices

Because the botnet targets both high-end servers and lowly IoT gear, the risk extends from corporate applications to home routers and embedded devices — amplifying the number of potential victims.

Resource Hijacking and DDoS

Compromised devices can be used for:

• Cryptomining, consuming CPU/GPU cycles and electricity
• Distributed denial-of-service (DDoS) attacks
• Network pivoting, enabling further lateral movement into enterprise infrastructure
• Spamming or data exfiltration, depending on additional payloads deployed

Mitigation and Defense Strategies

Given the scale and automation of RondoDox exploitation, defending against it requires urgent, multi-layered action:

✔ Immediate Patching

The most critical step is to patch vulnerable frameworks:

• Update Next.js and React Server Components to versions that address CVE-2025-55182.
• Apply all available security patches for IoT devices and web servers.
• Monitor vendor advisories and CVE releases actively.

✔ Network Segmentation

Separate IoT and consumer devices from core business networks using VLANs, firewalls, and access controls to prevent botnet spread into sensitive systems.

✔ Web Application Firewalls (WAFs)

Deploy or tune WAFs to detect and block malicious payloads, especially repeated attempts to exploit known RCE vectors like React2Shell.

✔ Intrusion Detection/Prevention Systems (IDS/IPS)

Set up IDS/IPS to recognize scanning behavior, unusual resource usage, or outbound connections to known command-and-control (C2) infrastructure.

✔ Log and Endpoint Monitoring

Monitor for unusual:

• Crontab modifications
• Unknown /tmp or /dev process execution
• Elevated CPU usage without justification
• Outbound connections to non-standard IPs and domains

Final Thoughts: A Persistent and Growing Threat

The RondoDox botnet represents one of the most aggressive and adaptive malware campaigns observed in 2025–2026. By combining automated scanning, modular payloads, and an expanding set of critical exploits like React2Shell, it has positioned itself as a major risk to organizations large and small.

With tens of thousands of systems still vulnerable and exploitation showing no signs of slowing, immediate mitigation measures and proactive patch management are essential. Failing to address these weaknesses leaves critical assets exposed to botnet recruitment, resource hijacking, DDoS participation, and other malicious outcomes — a stark reminder that consistent cybersecurity vigilance remains essential in an ever-evolving threat environment.