CampaignPublished 29 Dec 2025Updated 28 Jan 2026

RondoDoX Botnet Weaponizes React2Shell

Source AlienVault OTX General

Description

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.

Impact

European organizations face significant risks from this campaign, especially those deploying Next.js for web applications and relying on IoT devices in critical infrastructure. Unauthorized code execution on Next.js servers can lead to data theft, service disruption, and unauthorized access to sensitive information. The compromise of IoT devices facilitates large-scale botnet formation, enabling distributed denial-of-service (DDoS) attacks, cryptomining operations that degrade device performance, and further lateral movement within networks. Credential harvesting threatens both user and administrative accounts, increasing the risk of broader network compromise. The persistence of multi-architecture malware complicates detection and remediation efforts, potentially leading to prolonged exposure. Sectors such as manufacturing, healthcare, and smart city deployments, which heavily utilize IoT devices, are particularly vulnerable. The campaign’s rapid adaptation to new vulnerabilities increases the likelihood of sustained exploitation within European networks, potentially impacting confidentiality, integrity, and availability of critical services.

Defensive guidance

European organizations should immediately conduct comprehensive security assessments of all Next.js web applications to identify and remediate vulnerabilities, even in the absence of official patches. Deploy runtime application self-protection (RASP) and web application firewalls (WAF) with updated signatures specifically targeting React2Shell exploitation attempts. Implement strict network segmentation to isolate IoT devices from corporate and critical infrastructure networks, minimizing lateral movement opportunities. Enforce strong access controls and multi-factor authentication (MFA) on all administrative and user accounts to protect credentials. Regularly update and patch IoT device firmware where possible, and replace unsupported or insecure devices to reduce attack surface. Deploy advanced network monitoring and anomaly detection solutions to identify unusual traffic patterns indicative of botnet activity or cryptomining. Utilize threat intelligence feeds to block known malicious IP addresses and file hashes associated with RondoDoX. Conduct targeted employee awareness training focused on recognizing suspicious activity related to web applications and IoT devices. Finally, develop and regularly test incident response plans tailored to botnet and web application exploitation scenarios to ensure rapid containment and recovery.

Indicators of compromise

IP addresses 3

38.59.219.27
70.184.13.47
89.144.31.18

Hashes 8

3ba4d5e0cf0557f03ee5a97a2de56511
c798b4bcf337d1c7420871b9a4f55fa8
ca5515cb5a378bf71c5bef02184b083c126786b7
dc057522e04f37a6143cf6ce9b5d4a19aab8ef7a
50be5257678412f0810d46e0b0bc573eb65c6ce4617346c1527ff0dc9b7fc79e
858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb
895f8dff9cd26424b691a401c92fa7745e693275c38caf6a6aff277eadf2a70b
8e0bc23a87d349e5a5356252ce17576093b7858fdf6ea84919fbdcb2e117168e

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Jan 2026, 19:05 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

IP addresses 3

Hashes 8

Community reviews

Related threats