RondoDox botnet expands arsenal targeting 174 flaws, and hits 15,000 daily exploit attempts

RondoDox, a botnet active since 2024, ramped up a focused campaign between May 2025 and February 2026 targeting 174 vulnerabilities (148 mapped CVEs) with as many as 15,000 daily exploit attempts; researchers observed rapid adoption of new public PoCs (including React2Shell/CVE-2025-55182), waves of broad testing followed by consolidation on high-value exploits, inconsistent exploit implementations, and payload deployment such as cryptominers, while BitSight cautioned against misattributed findings about alleged loader-as-a-service or P2P C2 claims.