RondoDox v2: Evolution of RondoDox Botnet with 650% More Exploits
Nov. 10, 2025, 11:56 a.m.
Description
The RondoDox botnet has undergone a significant evolution, expanding its capabilities and target range. This new variant, RondoDox v2, demonstrates a 650% increase in exploitation vectors, moving beyond niche DVR targeting to include enterprise applications. Key features include over 75 exploitation vectors, new command and control infrastructure utilizing compromised residential IPs, enhanced obfuscation and persistence mechanisms, and an expanded ecosystem of targets. The botnet now employs a multi-architecture approach, supporting 16 different binary variants to maximize its reach across diverse device types.
Tags
Date
- Created: Nov. 10, 2025, 11:06 a.m.
- Published: Nov. 10, 2025, 11:06 a.m.
- Modified: Nov. 10, 2025, 11:56 a.m.
Indicators
- 691e4ec280aaff33270f33a9bb48a3fc38e2bd91c7359e687e3f0bd682f20b54
- 83.252.42.112
- 38.59.219.27
- 83.150.218.93
- http://74.194.191.52/rondo.xcw.sh||busybox
- http://74.194.191.52/rondo.xqe.sh|sh&echo
- http://74.194.191.52/rondo.qre.sh||busybox
- http://74.194.191.52/rondo.[variant].sh
- http://74.194.191.52/rondo.[arch].sh]
- http://74.194.191.52/rondo.[arch].sh
- http://74.194.191.52/rondo.x86_64
- http://74.194.191.52/rondo.sparc
- http://74.194.191.52/rondo.powerpc-440fp
- http://74.194.191.52/rondo.powerpc
- http://74.194.191.52/rondo.mipsel
- http://74.194.191.52/rondo.armv7l
- http://74.194.191.52/rondo.armv6l
- http://74.194.191.52/rondo.armv5l
- http://74.194.191.52/rondo.armv4l
- http://74.194.191.52/rondo.arc700
Attack Patterns
- RondoDox
- RondoDox
- CVE-2025-34037
- CVE-2022-37129
- CVE-2022-36553
- CVE-2020-27867
- CVE-2018-11714
- CVE-2017-18369
- CVE-2014-1635
- CVE-2025-4008
- CVE-2025-7414
- CVE-2025-5504
- CVE-2022-44149
- CVE-2025-1829
- CVE-2020-25506
- CVE-2023-52163
- CVE-2020-10987
- CVE-2023-47565
- CVE-2025-22905
- CVE-2024-12847
- CVE-2024-12856
- CVE-2024-10914
- CVE-2023-25280
- CVE-2024-7029
- CVE-2021-42013
- CVE-2014-6271
- CVE-2019-16920
- CVE-2016-6277
- CVE-2021-41773
- CVE-2017-18368
- CVE-2018-10561
- CVE-2015-2051
- CVE-2023-1389
- CVE-2023-26801
- CVE-2023-51833
- CVE-2024-3721
- CVE-2017-10271
Additional Informations
- Technology
- Telecommunications
- New Zealand