Cybercrime
,
Endpoint Security
,
Fraud Management & Cybercrime
The Campaign Compromises Open-Source Vulnerability to Hack IoT Devices at Scale
A botnet campaign has been deploying React2Shell exploits to compromise IoT devices and web-facing applications at scale, security researchers found.
Security firm CloudSEK uncovered the campaign and attributed it to the RondoDox botnet. The campaign, launched in March, began exploiting the remote code React2Shell exploit in Meta-developed, open-source React framework in December.
RondoDox is a relatively new botnet known for mimicking traffic from gaming platforms or virtual private network servers to evade detection.
In the latest campaign, the attackers first compromised web applications such as WordPress, Drupal, Struts 2 and WebLogic to gain initial access. The hackers then proceed to steal credentials to compromise the IoT devices. Among targeted devices are DLink, TP-Link, Netgear, Linksys, Asus and IP cameras.
“The activity spans from March 2025 to December 2025, showing quick adaptation to the latest trends in attacks by the threat actor group, not limiting themselves to deploying botnet payloads, web shells and crypto miners,” CloudSEK researchers said.
The React2Shell flaw, tracked as CVE-2025-55182, has a CVSS ranking of 10, the highest severity. Given the relative ease with which it can be exploited, hackers, including Chinese and North Korean state hackers, have been known to directly target cloud environments and workloads that run the framework. More than 77,000 IP addresses were found to be vulnerable to the flaw as of early December.
In the latest campaign, attackers targeted organizations running Next.js Server Actions, which is a React framework that controls HTTP requests and responses. “The vulnerability allows complete server compromise through deserialization flaws in Server Actions,” CloudSEK said.
Attackers then deploy a coinminer and Mirai IoT malware, and a Linux-focused botnet support framework for persistence, CloudSEK said.
To prevent potential attacks using the flaw, CloudSEK recommends that the attackers review all Next.js applications using Server Actions, disable remote management interfaces and isolate all IoT devices.