The RondoDox botnet is exploiting a Next.js vulnerability

CloudSEK has tracked the RondoDox botnet campaign over nine months. It began in March with reconnaissance and vulnerability scanning, expanded from April into web application and IoT targeting, and the botnet itself surfaced in July. From December, CVE-2025-55182 in Next.js has been actively exploited following an initial scanning period to find vulnerable servers. Payloads include React2Shell and cryptominers. The operators have moved from manual testing to hourly exploitation, and the botnet supports multiple architectures with fallback delivery mechanisms.

What this means for your organisation

Next.js is widely used for public websites and customer portals, and such systems are often owned by an agency or a product team rather than IT operations. After compromise comes the risk of credential theft and lateral movement further into the environment. With exploitation automated on an hourly cadence, the exposure window is short.

Berigo recommends

• Map which of your internet-facing services run Next.js, including those your supplier operates.
• Patch to a fixed version and ask the agency or hosting provider to confirm in writing that it is done.
• Separate web servers from internal networks so a compromise does not enable lateral movement.
• Check servers for unexpected CPU use or outbound connections dating from December onwards.

Source

• cloudsek.com