RondoDox botnet exploits React2Shell flaw to breach Next.js servers

RondoDox botnet exploits React2Shell (CVE-2025-55182), a critical unauthenticated remote code execution vulnerability that affects React Server Components (RSC) 'Flight' protocol implementations including Next.js. The vulnerability can be exploited via a single HTTP request. RondoDox started scanning for vulnerable Next.js servers on December 8 and began deploying botnet clients three days later. The botnet conducts hourly IoT exploitation waves targeting consumer and enterprise routers. After exploitation, it deploys multiple payloads including a coinminer (/nuts/poop), botnet loader and health checker (/nuts/bolts), and a Mirai variant (/nuts/x86). The 'bolts' component removes competing botnet malware, enforces persistence via /etc/crontab, and kills non-whitelisted processes every 45 seconds.