RondoDox Botnet is Using React2Shell to Hijack Thousands of Unpatched Devices

RondoDox is actively exploiting the critical Next.js React2Shell vulnerability (CVE-2025-55182) to build a large botnet, targeting websites, home routers, and IoT devices; Shadowserver observed over 90,300 vulnerable systems. The campaign progressed from manual testing to automated mass scanning and deployment of multiple malware variants (cryptominer, Mirai-like spreader, and a competitive 'health checker') across diverse architectures, with recommendations to apply Next.js patches and segment/update home devices.