RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits

Trend ZDI researchers describe RondoDox, an active, multivector botnet campaign using an "exploit shotgun" to target over 50 vulnerabilities across 30+ vendors (routers, DVRs/NVRs, CCTV, web servers). The report includes a timeline of in-the-wild exploitation, a catalog of observed CVEs (several added to CISA KEV), IoCs, hunting queries and detection rules, and notes distribution via a loader-as-a-service bundling RondoDox with Mirai/Morte.