216.73.217.22

Tracking RondoDox: Malware Exploiting Many IoT Vulnerabilities

· Published 26/11/2025 09:54 · Modified 21/12/2025 18:05

Export JSON

Essential information

Published
26/11/2025 09:54
Modified
21/12/2025 18:05
Tags
2025-11-26 CVE-2013-1599 CVE-2014-3206 CVE-2020-10987 CVE-2020-9054 CVE-2022-36553 CVE-2022-40619 CVE-2023-1389 CVE-2023-23333 CVE-2023-41011 CVE-2024-10914 CVE-2024-3721 CVE-2025-34043 CVE-2025-4008 CVE-2025-9528 botnet command injection iot mirai mirai variant multi-platform residential infrastructure rondodox shell script
Related entities
23 vulnerabilities (cve), 26 observables, 1 intrusion sets (apt), 20 techniques (mitre), 2 malware

Description

A new threat actor is distributing the malware, a variant of , targeting devices. The actor uses residential IP addresses for distribution and employs over a dozen exploits to target various vulnerabilities. The malware's first stage is a that attempts to disable security measures, remove competing malware, and download architecture-specific second-stage binaries. The campaign has been active since July 2025, with consistent use of a handful of distribution points. The actor targets home routers and other devices using multiple CVEs and generic attempts.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

External references