Tracking RondoDox: Malware Exploiting Many IoT Vulnerabilities

Nov. 26, 2025, 11:18 a.m.

Description

A new threat actor is distributing the RondoDox malware, a variant of Mirai, targeting IoT devices. The actor uses residential IP addresses for distribution and employs over a dozen exploits to target various IoT vulnerabilities. The malware's first stage is a shell script that attempts to disable security measures, remove competing malware, and download architecture-specific second-stage binaries. The campaign has been active since July 2025, with consistent use of a handful of distribution points. The actor targets home routers and other IoT devices using multiple CVEs and generic command injection attempts.

Indicators

  • f11ede0c682e818357943a166239867a19b0c1d321e84213e28e21beb2c49c87
  • f0a73797caa35d4d62a23358fa8102d6c434cfc5177623d5dfd2a3efaff66aae
  • e683864f4016b24b164ebaa5d900963b730a1df45bcbf9fa947b644d673dbc21
  • df9f756f355d1122e46ce12bb84553c89cdab71c6402a257b78bc768578f51c7
  • cf7a5027a0e562b7749c8025c0394bc3c3208b7b5ce070dcd15787450332efa8
  • c987e85b19c6462b06615a61998618c0e7d22ac5e38034e53ef0e34bd452464d
  • c789f239a9cf039752e3926ee3b4387b3f6a1f6657531277caebf90685b018a2
  • 8634f53097f511dd1b7c253a0fbc4bc468e3ee38abd0490a39dd92edaee905de
  • a65e3438103d31ccb213083b2b6ef40b558580b4246251b558fc68e6a2a2ba92
  • 81200976b8717c340041eee6ff051e1a87f8f73d86a9e17465b34be4c9488839
  • 69a17194dba061f56ec3a23debfa1d3fdee7dd92789af17038387b294093aa5d
  • 5cbe0f93c03b04b6100545448fee6db2a032a7cb13be45421d4ab377d1f88bf6
  • 470a74b888617299820acbe2daf03001eca7dc64a7002cd00beb163b3663187e
  • 3a4afea2c16905816b922229dc5d03311d58c470fa4580dcd9248302bcdfbdc4
  • 3852442d56b08eabb8060f6b72234ff0a5400b89dddf31560b2dc5d8b16c29fa
  • 2af74246497c671cc9976cd9919fdc4beaa459e9b4b30a42f561b45919da950b
  • 032d7b946259add6db097d3ee4375caffe2c7dcf7da81e72c32eaa24b3bde164
  • 17be568b6b2acb3b237c6dc81b3692976bb83eea76a7a26fd405805d34901016
  • 83.252.42.112
  • 38.59.219.27
  • 74.194.191.52
  • 192.183.232.142
  • http://74.194.191.52/rondo.mips||curl
  • http://74.194.191.52/rondo.mips||busybox
  • http://74.194.191.52/rondo.mips
  • bang2012@tutanota.de

Linked vulnerabilities