Cybersecurity researchers have disclosed details of a persistent nine-month-long campaign that has targeted Internet of Things (IoT) devices and web applications to enroll them into a botnet known as RondoDox.
As of December 2025, the activity has been observed leveraging the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) flaw as an initial access vector, CloudSEK said in an analysis.
React2Shell is the name assigned to a critical security vulnerability in React Server Components (RSC) and Next.js that could allow unauthenticated attackers to achieve remote code execution on susceptible devices.
According to statistics from the Shadowserver Foundation, there are about 90,300 instances that remain susceptible to the vulnerability as of December 31, 2025, out of which 68,400 instances are located in the U.S., followed by Germany (4,300), France (2,800), and India (1,500).
RondoDox, which emerged in early 2025, has broadened its scale by adding new N-day security vulnerabilities to its arsenal, including CVE-2023-1389 and CVE-2025-24893. It’s worth noting that the abuse of React2Shell to spread the botnet was previously highlighted by Darktrace, Kaspersky, and VulnCheck.
The RondoDox botnet campaign is assessed to have gone through three distinct phases prior to the exploitation of CVE-2025-55182 –
March – April 2025 – Initial reconnaissance and manual vulnerability scanning
April – June 2025 – Daily mass vulnerability probing of web applications like WordPress, Drupal, and Struts2, and IoT devices like Wavlink routers
July – early December 2025 – Hourly automated deployment on a large-scale
In the attacks detected in December 2025, the threat actors are said to have initiated scans to identify vulnerable Next.js servers, followed by attempts to drop cryptocurrency miners (“/nuts/poop”), a botnet loader and health checker (“/nuts/bolts”), and a Mirai botnet variant (“/nuts/x86”) on infected devices.
“/nuts/bolts” is designed to terminate competing malware and coin miners before downloading the main bot binary from its command-and-control (C2) server. One variant of the tool has been found to remove known botnets, Docker-based payloads, artifacts left from prior campaigns, and associated cron jobs, while also setting up persistence using “/etc/crontab.”
“It continuously scans /proc to enumerate running executables and kills non-whitelisted processes every ~45 seconds, effectively preventing reinfection by rival actors,” CloudSEK said.
To mitigate the risk posed by this threat, organizations are advised to update Next.js to a patched version as soon as possible, segment all IoT devices into dedicated VLANs, deploy Web Application Firewalls (WAFs), monitor for suspicious process execution, and block known C2 infrastructure.
Millie Bobby Brown has starred in Stranger Things since its launch in 2016
Warning: This article contains spoilers about the final episode of Stranger Things
Stranger Things has drawn to an epic and emotional close, with a dramatic two-hour finale that briefly jammed Netflix’s servers.
Viewers rushed to watch the final episode, which concludes the 10-year run of the sci-fi horror series, as it was released at 01:00 GMT.
Some fans also attended special cinema screenings of the finale in cities across the US and Canada, several of which were attended by the show’s stars.
Set in the fictional town of Hawkins, Indiana, Stranger Things first aired in 2016 and stars Millie Bobby Brown, Winona Ryder and David Harbour.
Several fans said they were shown an error message as they tried to play it – something that often happens with big new releases on streaming platforms.
But the episode was soon restored and viewers were able to watch a finale that included massive battle scenes and emotional tributes that brought in all five seasons, giving closure to the characters that we’ve fallen in love with over the years.
The finale left you on the edge of your seat at moments and had you both cheering and crying in others.
Netflix
Finn Wolfhard was cheered by fans as he arrived to introduce the finale at a screening in Vancouver
A lot was riding on Netflix and The Duffer Brothers, who created the 1980s-inspired, monster-infused, inter-dimensional series. Ending any beloved series comes with both anticipation and a lot of critics.
So far this season, fans have picked apart scenes and gone through past seasons in an attempt to piece together how it all might end in the Upside Down.
Viewers have been quick to point out gaps in the story or issues they felt with the script writing, pointing out flaws in Will Byers’ coming out scene or issues such as Holly Wheeler’s jacket having a logo for Under Amour (a brand that wasn’t created until 1996) appearing on screen.
Countless theories discussed on social media only hyped up the ending of this saga.
Fans guessed about possibilities like time travel coming into play (clocks have been a major plot point for multiple seasons, after all), took bets on what main character might die and some had far-fetched thoughts on Henry Creel “Vecna” using mind control on the characters throughout this season to explain various holes in the storytelling.
In the end, some theories were spot on. Others, not one bit.
Do not read any further if you do not want to know what happens in the finale of Stranger Things.
Getty Images
Actor Brett Gelman attended a screening in Topanga as part of the multi-city finale premiere
Netflix
These fans attended a screening in Los Angeles to watch the finale on the big screen
Getty Images
Actress Cara Buono attended a premiere in New York and introduced the finale from cinema stage
In the finale, we see an epic final fight that requires all the characters to finally defeat Vecna and the Mind Flayer before worlds merge and Hawkins, Indiana – and Earth as we know it – is taken over.
We don’t see dramatic deaths in the core group of stars we’ve come to love over five seasons – though we did see the death of Kali (Eight).
What happened to Eleven, though, is up for interpretation. She is left with an impossible choice.
At first, viewers are left to believe she chose to remain behind in the Upside Down as it explodes and is demolished forever in order to eliminate the possibility of being used to create more children with powers like hers.
But later, in a lengthy epilogue scene, Mike Wheeler takes us down another possibility – Eleven using Kali’s illusion powers to make it seem as though she died before making a grand escape.
Netflix
He says he thinks she finally made it the place they talked about running off to – a land with three waterfalls.
Mike says it’s what he likes to believe – and each member of their Dungeons and Dragons party – Will, Dustin, Lucas and Max – all agree that they, too, believe.
It’s a fitting end that leaves open the possibility that Eleven, too, has a happy ending.
The epilogue takes us 18 months into the future after the Upside Down is demolished and Vecna – and the Mind Flayer – is defeated.
We see Hooper and Joyce get engaged and the older crew of teens talk about their lives in university and in their careers.
It’s a happy ending for everyone.
But even with such an epic finale, there are certainly holes in the story that weren’t fully explained in the last episode.
It’s sure to be a finale that pleases some fans and has others wanting more.
Getty Images
Several fans dressed up to attend the finale screenings – including this pair in Vancouver
Netflix
Netflix handed out merchandise such as bags, figurines and T-shirts at many of the screenings
Getty Images
Two fans in Vancouver, pictured with a special Demogorgon Crunch breakfast cereal
In the US and Canada, the finale was given a full cinematic release in theatres.
Fans in Los Angeles stood in the rain for hours outside The Egyptian Theatre along Hollywood Boulevard to watch it in one of Netflix’s very own theatres.
The streaming giant, which is currently attempting to purchase Warner Bros, renovated the historic 1922 theatre and now uses it to host premieres and special screenings of projects.
Fans, many dressed up as characters or demogorgons, took pictures in the Stranger Things – themed lobby. Netflix handed out special merchandise, such as T-shirts and figurines.
While waiting for the special screening, fans in the theatre traded theories on who might die or how it all could end. Many pointed to popular theories of Steve Harrington’s demise and clung to hope that he would survive the last battle.
Getty Images
Fans in Los Angeles braved the rain to attend a finale screening at Hollywood’s Egyptian Theatre
Getty Images
Fans Liv and Alina Valdez described the ending as “an emotional roller-coaster”
Liv and Alina Valdez, dressed up as fan favourite buds Steve Harrington and Dustin Henderson, and said they couldn’t have been more pleased with how it all ended.
“It’s been basically 10 years,” Liv told BBC News, wearing Harrington’s Scoops Ahoy ice cream shop uniform outside the theatre.
“The Duffer Brothers did a good job of giving the audience what we needed, maybe not necessarily what we wanted.”
They both applauded the both happy-at-times and perhaps, bittersweet ending.
“It was an emotional roller-coaster,” Alina added, noting Eleven’s up-for-interpretation-ending was perfectly done.
“It was just a lot of emotions,” Diana Espinoza told the BBC, standing in the lobby of the theatre with a new Demogorgon plush.
“I lost control of my tears!”
She donned a lengthy mind-flayer dress to the screening and said she’d attempted in vain to steer clear of various fan theories that have been going viral on social media because she wanted to be “blown away” by the final episode.
Being in a theatre with fellow fans screaming and crying during pivotal scenes was the cherry on top.
“I loved the finale. There was no better way to end this,” she said, calling it both bittersweet, emotional and the “happy ending” that everyone deserved.
BBC New’s Silvia Costeloe reports from the Swiss ski resort of Crans-Montana, where it is believed dozens of people have died in a fire in a bar which broke out shortly after midnight.
Authorities also say more than 100 people were injured in the incident.
