RondoDoX Botnet Exploits Next.js Vulnerability in Multi-Month Campaign
Summary
CloudSEK analyzed nine months of C2 logs showing RondoDoX targeting web applications and IoT devices, with Next.js Server Actions exploitation and botnet deployments surging in December 2025.
Key points
- CloudSEK reports three campaign phases from March to December 2025, supported by command-and-control logs and attack timestamps.
- The activity included automated probing of web applications and IoT devices, including routers and network appliances.
- From December 13, the actors used Next.js Server Actions exploitation to test for remote code execution and deploy payloads.
- Payloads included Rondo botnet variants, Mirai, and a coinminer; some scripts also removed competing malware and established persistence.
- CloudSEK identified six C2 servers and reported more than 40 repeat attacks against the vulnerability within six days.
- The report recommends patching vulnerable Next.js applications, hardening and segmenting IoT devices, and blocking identified C2 infrastructure.
Article Details
- Attack Vectors
- Automated exploitation of internet-facing web applications, including Next.js Server Actions, Drupal, Struts2, WordPress Gravity Forms, and WebLogic.
- Command injection through router and IoT device diagnostic interfaces.
- Next.js Server Actions exploitation to execute commands, download ELF payloads, and run them in the background.
- Deployment of botnet payloads and coinminers across IoT devices and compromised servers.
- Defensive Notes
- Audit Next.js applications using Server Actions, validate serialized input, apply vendor patches, and consider disabling exposed Server Actions until patches are validated.
- Segment IoT devices, disable remote management, change default credentials, apply firmware updates, and restrict outbound connections to trusted destinations.
- Use web application firewall rules and input validation to block command injection; disable unnecessary command-execution features in administrative interfaces.
- Block the identified C2 IP addresses at perimeter firewalls and DNS resolvers; monitor for the reported URI patterns and suspicious process execution, permission changes, and outbound connections.
- Require VPN or jump-host access for device management interfaces, enable multifactor authentication, and log administrative actions.
- Patch critical internet-facing vulnerabilities promptly and maintain an inventory of devices and firmware versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 38[.]59[.]219[.]27 | C2 server reported serving Rondo botnet malware. |
| IPV4 | 41[.]231[.]37[.]153 | C2 server listed in the article's confirmed C2 infrastructure. |
| IPV4 | 5[.]231[.]70[.]66 | Additional C2 found by pivoting on an image hash, according to the article. |
| IPV4 | 5[.]255[.]121[.]141 | C2 server for the Next.js exploitation wave's botnet deployment. |
| IPV4 | 51[.]81[.]104[.]115 | C2 and payload host used in the Next.js exploitation wave. |
| IPV4 | 70[.]184[.]13[.]47 | C2 server listed in the article's confirmed C2 infrastructure. |
| IPV4 | 74[.]194[.]191[.]52 | C2 server used to deploy Rondo script variants. |
| IPV4 | 89[.]144[.]31[.]18 | Listed as a confirmed C2 server in the article's IOC table. |
| SHA256 | 50be5257678412f0810d46e0b0bc573eb65c6ce4617346c1527ff0dc9b7fc79e | SHA-256 identified as a persistence payload. |
| SHA256 | 858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb | SHA-256 of the /nuts/x86 Mirai payload. |
| SHA256 | 895f8dff9cd26424b691a401c92fa7745e693275c38caf6a6aff277eadf2a70b | SHA-256 of the /nuts/poop coinminer payload. |
| SHA256 | 8e0bc23a87d349e5a5356252ce17576093b7858fdf6ea84919fbdcb2e117168e | SHA-256 of the /nuts/bolts health-check payload. |
MITRE ATT&CK
T1053.003 · CronA /nuts/bolts variant reportedly enforced persistence through /etc/crontab.T1057 · Process DiscoveryThe payload continuously scanned /proc to enumerate running executables.T1059.004 · Unix ShellThe article describes shell commands and downloaded binaries being executed on compromised systems.T1105 · Ingress Tool TransferPayloads were downloaded from C2 infrastructure to compromised servers and IoT devices.T1190 · Exploit Public-Facing ApplicationThe campaign exploited vulnerable internet-facing web applications, including Next.js Server Actions and other named web platforms.T1496 · Resource HijackingThe campaign deployed coinminers, including the payload identified at /nuts/poop.
Malware
Mirai/nuts/x86 - MiraiRondoRondo botnet is the primary malware family with 10+ variantsRondoBOTlong-term stability on compromised hosts. The first variant operates as a loader and health-checker for RondoBOT, terminating competing malware and coin miners before downloading the primary bot binary and
Products
ASUSIoT Device Compromise: Organizations with internet-facing routers (DLink, TP-Link, Netgear, Linksys, ASUS), IP cameras, and network appliances face automated hourly exploitation attempts, leading to potentialDLinkWidespread IoT Device Compromise: Organizations with internet-facing routers (DLink, TP-Link, Netgear, Linksys, ASUS), IP cameras, and network appliances face automated hourly exploitation attempts, leading to potentialDrupalDrupal exploitation:Gravity FormsWordPress Gravity Forms Unique ID Plugin:LinksysJuly 18-20, 2025 - Linksys Router CampaignNetgearWidespread IoT Device Compromise: Organizations with internet-facing routers (DLink, TP-Link, Netgear, Linksys, ASUS), IP cameras, and network appliances face automated hourly exploitation attempts, leading to potentialNext.jsthemselves to deploying botnet payloads, web shells, and cryptominers - but also weaponizing the latest Next.js vulnerability. On 10th December, Darktrace reported about React2Shell exploitation from their honeypotStruts2Struts2 OGNL injection:TP-LinkWidespread IoT Device Compromise: Organizations with internet-facing routers (DLink, TP-Link, Netgear, Linksys, ASUS), IP cameras, and network appliances face automated hourly exploitation attempts, leading to potentialWebLogicWebLogic exploitation:WordPressWordPress Gravity Forms Unique ID Plugin: