216.73.216.233

RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities

· Published 11/03/2026 15:49 · Modified 16/03/2026 09:52

Export JSON

Essential information

Published
11/03/2026 15:49
Modified
16/03/2026 09:52
Tags
2026-03-11 botnet ddos iot rondodox vulnerability exploitation xmrig
Related entities
12 vulnerabilities (cve), 29 observables, 1 intrusion sets (apt), 16 techniques (mitre), 2 malware, 1 others

Description

The has emerged as a significant threat, exploiting 174 different vulnerabilities since May 2025. It primarily targets devices and internet-exposed services for DoS attacks. The 's infrastructure includes exploiting and hosting components, with evidence suggesting the use of compromised residential IPs. 's operators have shown a rapid adoption of newly disclosed vulnerabilities, sometimes exploiting them within days of publication. The 's evolution includes a shift from a shotgun approach using numerous exploits to a more focused strategy targeting recent, critical vulnerabilities. The malware shares similarities with Mirai but focuses solely on DoS attacks. This threat highlights the importance of exposure management in cybersecurity.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

External references