Botnet Loader-as-a-Service Infrastructure Distributing RondoDoX and Mirai Payloads

CloudSEK uncovered a six-month loader-as-a-service botnet operation (RondoDoX / Morte / Mirai) that systematically exploits unsanitized web GUI fields, default credentials and known CVEs (WebLogic, WordPress, vBulletin, etc.) to achieve remote code execution on SOHO routers, embedded Linux devices and enterprise apps; operators deliver staged droppers and native payloads (cryptominers, Morte binaries), with extensive IOCs, impact analysis and prioritized remediation guidance provided.