Signal
RondoDox botnet exploiting React2Shell, targeting next.js and devices
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-01-02 11:12 UTCUpdated 2026-01-03 06:06 UTC
rss
cybersecuritybotnetreactnextjsiotvulnerability_exploitation
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
A newly reported botnet campaign is being tracked as it pivots from vulnerability “weaponization” to broad exploitation. Multiple reports describe RondoDox leveraging the React2Shell flaw to compromise vulnerable systems, with emphasis on scale and the targeting of vulnerable Next.js servers and other devices since December.
Score total
1.03
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Both reports highlight activity beginning in December and being actively exploited
- New coverage consolidates CloudSEK’s findings and attribution to RondoDox
- Attention is drawn to weaponization and operational use of React2Shell
Why it matters
- A botnet exploiting a widely used open-source framework flaw can enable broad compromise at scale
- Reports indicate targeting spans Next.js servers and multiple device types
- Attribution and timing details help defenders prioritize patching and monitoring
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- CloudSEK uncovered a botnet campaign exploiting the React2Shell vulnerability since December and attributed it to RondoDox.
- In December, the botnet operators focused on weaponizing the React2Shell flaw to compromise vulnerable Next.js servers.
How sources frame it
- SecurityWeek: neutral
- BankInfoSecurity: neutral
Two independent security outlets describe the same CloudSEK-attributed botnet activity exploiting React2Shell since December.
All evidence
All evidence
RondoDox Botnet Exploiting Devices With React2Shell Flaw
BankInfoSecurity · bankinfosecurity.com · 2026-01-03 06:06 UTC
RondoDox Botnet Exploiting React2Shell Vulnerability
SecurityWeek · securityweek.com · 2026-01-02 11:12 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- BankInfoSecurity (1)
- SecurityWeek (1)
Top origin domains (this list)
- bankinfosecurity.com (1)
- securityweek.com (1)