The Shotgun Approach: BitSight Exposes RondoDox Botnet’s Rapid-Fire 174-Exploit Arsenal Targeting IoT

BitSight researcher João Godinho exposes RondoDox, an IoT-focused botnet active since May 2025 that uses a “shotgun approach” with an unusually large arsenal (174 distinct exploits) to compromise internet-exposed devices, peaked at ~15,000 daily exploitation attempts, adapts quickly to new vulnerabilities (sometimes exploiting before CVE publication), stores payloads on compromised residential hosts, and primarily delivers DoS-capable malware while attempting to remove competing malware.