December 2025, the RondoDox botnet operators have been targeting Next.js servers impacted by the React2Shell vulnerability.

RondoDox botnet exploits the React2Shell vulnerability in Next.js, with over 90,000 exposed systems used to deploy miners and ...

The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js ...

The attack tops the 22 Tbps assault from September. Cloudflare also estimates that the Aisuru botnet has grown to span 1 to 4 million infected devices globally.

Consisting of over 1.8 million infected devices, the Kimwolf Android Botnet focuses on traffic proxying, but can also launch ...

A new report out today from Fortinet Inc.’s FortiGuard Labs details the activities of two different botnets observed through October and November that are being spread through vulnerabilities in ...