RondoDox botnet pressure on IoT devices and web apps

RondoDox is running a persistent botnet campaign against exposed **IoT devices** and **web applications**, and by December 2025 it was exploiting **React Server Components (CVE-2025-55182)** alongside other N-day flaws as one access path into internet-facing systems. The operation began with initial reconnaissance and manual vulnerability scanning in March-April 2025. It then moved into daily mass probing and later hourly automated deployment, which points to a more scalable intrusion pattern. The exposed surface is broad enough to include **Next.js**, **WordPress**, **Drupal**, **Struts2**, and **Wavlink routers**. Recommended defensive steps include updating **Next.js**, segmenting IoT devices into VLANs, deploying WAFs, monitoring suspicious process execution, and blocking known C2 infrastructure. Reach remains unquantified, but available evidence places observed activity in the United States, Germany, France, and India, and the campaign was still active in December 2025.