RondoDox Botnet Abuses React2Shell Flaw to Take Over IoT Devices and Web Servers

Active exploitation of a critical application flaw enables large-scale botnet expansion

Severity

CRITICAL – Active Exploitation / Botnet Propagation

When

Recently observed (ongoing)

Technical Overview

Threat intelligence teams have identified active exploitation of the React2Shell vulnerability by the RondoDox botnet, enabling attackers to compromise both IoT devices and internet-facing web servers at scale. The campaign demonstrates how rapidly threat actors weaponize newly disclosed application flaws to expand botnet infrastructure.

Unlike targeted intrusion campaigns, RondoDox operates opportunistically. As a result, any exposed and unpatched system becomes a viable target. Consequently, the botnet continues to grow across heterogeneous environments, including embedded devices and traditional server infrastructure.

Exploitation Mechanics

The attack chain begins with automated scanning for systems vulnerable to React2Shell, a remote code execution flaw affecting certain React-based deployments. Once the botnet identifies a vulnerable host, it sends crafted requests that trigger arbitrary command execution.

After successful exploitation, the botnet immediately deploys a lightweight loader. This loader then retrieves the RondoDox payload, establishes persistence, and connects the compromised system to command-and-control (C2) infrastructure.

Additionally, the malware adapts its payload depending on the target environment. On IoT devices, it prioritizes stability and persistence. On web servers, it enables higher resource usage and lateral scanning.

Botnet Capabilities & Behavior

Once active, RondoDox enables attackers to:

• Execute remote commands
• Enlist devices into coordinated DDoS operations
• Scan for additional vulnerable systems
• Maintain persistence across reboots
• Relay traffic through compromised infrastructure

Moreover, the botnet leverages distributed C2 endpoints and encrypted communication channels. Therefore, traditional signature-based defenses often struggle to detect early-stage infections.

Impact

The campaign significantly increases risk across both consumer and enterprise environments. First, compromised IoT devices contribute to botnet-driven denial-of-service attacks. Next, hijacked web servers may serve as launch points for further exploitation or data theft.

As a result, organizations face:

• Service disruption
• Infrastructure abuse
• Reputational damage
• Increased exposure to secondary attacks

Furthermore, because exploitation requires no authentication, the barrier to compromise remains low.

Key Risk

Unpatched React-based services exposed to the internet create immediate botnet entry points. Consequently, delayed patching directly increases the likelihood of compromise.

Recommended Defensive Actions

• Patch affected React deployments immediately
• Identify and isolate internet-facing services
• Monitor for abnormal process execution and outbound connections
• Inspect IoT devices for unauthorized services or traffic
• Enforce network segmentation between IoT and core infrastructure

Additionally, organizations should assume active scanning is ongoing and prioritize remediation accordingly.