On January 13 2026, we have only reported that the RondoDox is mining Monero 1 though it has the ability of DDoS attack like the other IoT botnets. The reason we didn’t report about the DDoS attack functionality was that the malware itself was only keeping a connection with the command and control (C2) server by repeating keepalive commands except a few DDoS attack trials while the downloaded mining tool was running separately for a long time. About 10 months after the massive exploitation in July 2025, NICT Cyber Threat analysis Office has identidied that the RondoDox C2 began to send the DDoS attack commands in May 2026.
It was still under development
The first attack on May 9 was clearly for the test because it targets its own download server of RondoDox 204.10.194[.]134 by a human-readable command "spoof" in the encrypted C2 communication protocol. This command name sounds like a DDoS attack vector but actually "spoof" command sends only one spoofed TCP data packet which contains the true global IP address information of the victim device obtained from the ipify service. It is expected that the spoofing capabilities are managed by this command just as RapperBot and AISURU had been managing the spoofing capability list by using the spoofed UDP packet to the C2 server.
RondoDox has launched the actual DDoS attacks since May 19. We confirmed that these DDoS attack commands were actually working in the wild by the analysis of the reflection packets of the spoofed DDoS attacks captured by our NICTER sensors.
The first "rand" option in the Figure 1 applies a TCP flag randomly chosen from the predefined list of 8 combinations “SYN, SYN/ACK, ACK, PSH/ACK, RST/ACK, SYN/PSH/RST, FIN/ACK, FIN/PSH/ACK”, and the second "rand" option creates the spoofed packet with the random source IP addresses. These random IP addresses selected in this command in the wild have matched multiple sensors of our NICTER system and 605 reflected packets from the attacked IP address have been captured. The UTC timestamp of this attack command 2026/05/21 21:59:27 perfectly matches the first detection time of NICTER.
However, C2 was sending only less than 60 DDoS attacks daily in parallel with the frequent malware updates in the beginning.
Where is the botnet owner?
If the malware development is still in progress, the launched command timestamp is valuable information for the time zone analysis.
The hourly C2 command counts from January 2 to July 3 indicate that the botnet owner’s residence would be located around the Pacific Standard Time zone. A certain day’s detailed command timestamps would also show that the botnet owner takes a breakfast, a lunch and a dinner, and is testing RondoDox from 6AM to 0AM at the Pacific time zone.
There is only the North America in the Pacific time zone. The most likely botnet owner’s location is the western region of the United States or Canada.
Enhance DDoS
We began to track RondoDox C2 on December 31 2025 after the deep analysis of the December 7 version obtained from VirusTotal. Some IoT malwares have the remote shell functionality like the Aisuru botnet which has the reverse shell command but usually they don’t use that for the malware updates so often. In RondoDox case, it is expected that the remote shell command is crutial for updating the malware frequently because it appplies too many different vulnerabilities to exploit the victim devices. Therefore, most of the updates were triggered by the remote shell command in the C2 communication and we received 24 remote shell commands for the malware updates so far.
C2 kept silent with only the keepalive commands for over 3 months after a few DDoS attack trials at the end of January, and the botnet owner began to update the malware on May 7 with changing the download server of the mining tool at first.
After launching the actual DDoS attacks on May 19, the version number was assigned to RondoDox malware since May 30. RondoDox doesn’t have a capability of adding the option of the multiple attack targets because of the coding structure for the command parsing. Instead of the multiple attack targets option, the botnet owner added the mask prefix option for targeting the subnet IP address in version 2.
// UDP attack command parsing
// data_mode : raw rdns dns valve roblox wireguard openvpn openvpnauth openvpncrypt
// openvpntcp openvpnauthtcp openvpncrypttcp dayz fortnite fivem raknet
// mcrealm darkanddarker discord discord2 stun rtc dtls samp ssh mcjava
// cs2 csgo
n = sscanf(str, "%s %s %s %d %d %d %d %d %d", opt->data_mode, opt->target_ip
, opt->duration, opt->dst_port, opt->data_size, opt->src_port
, opt->process_num, opt->interval_time, opt->target_prefix);
On June 8, “icmp”, “gre”, “raw” and the other attacks were tested, and the malware was updated to version 3 for sending the verification result of the network socket creation capabilities to C2. That version also added new DDoS attack vectors “tcp2” and “tcpbypass”.
In version 4, the second argument was added for enabling multiple RondoDox instances.
// when the second argument is greater than 1, multiple instances will be allowed.
$rondo [vulnerability name].[CPU architecture] [multiple instances flag]
In version 5, the network socket creation tests were reduced to only for the IPPROTO_RAW socket, and “handshake” option was added for the attack vectors “tcp” and “tcp2” but it didn’t work because of the inconsistency between the “sscanf” format string and the additional option.
In version 6, that bug has been corrected, and two more options were added. The attack vector “tcpbypass” and the spoofed source IP range option “ovh” which makes the reflection attacks to the specific organizations have been removed.
In version 7, the attack vector “socket” was added, and version 8 is missing in our observation. In version 9, the new C2 server was added, and the string obfuscation parameters were changed. The “killer” function for the competitors and the sandboxes was also updated by using the Netlink.
On July 13, version 10 has been released with some small updates like an additional option of the payload data size. After that, the total DDoS attack duration has increased.
| Ver. | Date | Update |
|---|---|---|
| - | First submission on 2025-12-07 (VirusTotal) | |
| 2 | Add mask prefix option for targeting subnet IP. | |
| 3 | Add network socket creation tests. | |
| 4 | Add second argument for enabling multiple instances. | |
| 5 | Reduce network socket creation tests. A bug in “tcp”/“tcp2”. | |
| 6 | Fixed the bug. Remove “tcpbypass” and the option “ovh”. | |
| 7 | Add the attack vector “socket”. | |
| 9 | Add C2. Change string obfuscation parameters. | |
| 10 | Small updates like adding DDoS attack option. |
Development completed
The activity time range also changed at the same time of the increase of the total DDoS attack duration on July 15. It is no longer limited to Pacific Standard Time and does not depend on any specific time zone.
The DDoS attack targets also show that the distribution has changed on July 15. These data indicate that the botnet owner has completed the develoment of RondoDox and might have begun to operate the DDoS-for-hire.
Conclusion
RondoDox which was indentified by Fortinet’s FortiGuard Labs first in May 2025 2 is expanding the botnet by using a lot of vulnerabilities 3 4, and it’s malware has already been analyzed deeply by Bitsight 5. NICT Cyber Threat analysis Office has identified that RondoDox has begun to actively operate the DDoS attack functionality in the wild. We analyzed the malwares built for ARMv7 CPU core architecture which mainly aim to infect IoT devices like routers and network cameras. IoT devices directly exposed to the internet must be securely controlled to prevent the unauthorized access as NOTICE project warns. NICT is a member of NOTICE project.
- Set an enough complex password that cannot easily guessed.
- Update the firmware when it is outdated.
- Turn off unused features.
- Consider replacing unsupported vulnerable device with a new device.
IoC
C2: (Hardcoded, no domain.)
45.94.31[.]89
45.125.66[.]100
45.153.34[.]46
Download server:
41.231.37[.]153 (~ Jan 12)
204.10.194[.]134 (~ Jun 13)
45.153.34[.]153
SHA256:
2025/12/7 e52ad4e490fa762002ec0d1f918c81841a86f6b7492fdd5881be68b6d3f1a2b4
Version 2 02498daa5b3e5fbdf6ee64f7ed93654508e4a3dd2c2d74df4e7216589eb329b1
Version 3 707eea1fec7bc628630696ce96d68d8658fa9d62146cbd7bc3a1ccad83090402
Version 4 c7d00e3c5da44ab369cfcba400900f3417ecf0e43c2bee9e39186dd8cc7eae7d
Version 5 f804bdce4da9335a4580bf163e2c82a6c72a6e11b539df36656631e49251a8c4
Version 6 5fae68dbcc84ac2e2982c73a56c2956bd6425012909d2803b2cc64b18cf7e604
Version 7 e532a46a4401eb1b88e9ec860f49442a65c5635f0cfae90bf3f884708cf48b05
Version 9 10f40192239b81bb3b9c3aa1ebb11b312077be0dc0e211492fd0e8dfbc0f4463
Version 10 f5e21d36221d97389f9ca896a7b397040f70422eb20fa53b26e629c9a7835753
-
https://blog.nicter.jp/2026/01/rondodox_2026_1g/ (Japanese) ↩︎
-
https://www.fortinet.com/blog/threat-research/rondobox-unveiled-breaking-down-a-botnet-threat ↩︎
-
https://www.trendaisecurity.com/fr/resources-insights/research/the-industrialization-of-botnets-automation-and-scale-as-a-new-threat-infrastructure ↩︎
-
https://www.cloudsek.com/blog/rondodox-botnet-weaponizes-react2shell ↩︎
-
https://www.bitsight.com/blog/rondodox-botnet-malware-analysis ↩︎