Author: Samuel Alejandro

The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to compromise Next.js servers, deploying malware and cryptominers. This large-scale botnet, previously known for targeting various n-day flaws, has recently intensified its focus on React2Shell, with CloudSEK reporting significant exploitation attempts and the deployment of coinminers and Mirai variants.