RondoDox Botnet Expands Scope With React2Shell Exploitation

Researchers observed the RondoDox botnet actively exploiting the React2Shell vulnerability (CVE-2025-55182) and numerous other edge/IoT flaws to scan for vulnerable Next.js/React servers and deploy cryptominers, Mirai-based botnet variants, and a persistent loader that removes competing malware and enforces persistence across x86, x86_64, MIPS, ARM, and PowerPC devices; roughly 90,300 exposed vulnerable servers were identified and mitigations such as patching, network segmentation, WAFs, monitoring for unknown processes/cron jobs, and blocking C2 infrastructure are recommended.