RondoDox Botnet Exploits React2Shell to Breach Next.js Servers

Security researchers have identified an active campaign in which the RondoDox botnet is exploiting the React2Shell vulnerability to compromise internet-facing Next.js servers. The attacks allow remote code execution without authentication, enabling threat actors to deploy malware at scale.

The activity highlights how quickly newly disclosed application flaws can be weaponized by automated botnets.

What Is the React2Shell Vulnerability

React2Shell is a critical flaw affecting React Server Components used by modern web frameworks, including Next.js. The issue allows attackers to execute arbitrary commands on a server by sending specially crafted requests that abuse how server-side components process input.

Because the vulnerability does not require authentication, any exposed and unpatched server can be targeted directly from the internet. This makes the flaw particularly dangerous for production environments running default configurations.

How the RondoDox Botnet Exploits the Flaw

The RondoDox botnet scans the internet for vulnerable Next.js servers and attempts exploitation automatically. Once a target responds, the botnet delivers commands that execute directly on the server.

After successful exploitation, the attacker installs malicious payloads that establish persistence and allow continued remote control. The process requires no user interaction and can complete within seconds.

Malware Deployed on Compromised Servers

Following a successful breach, the RondoDox botnet typically deploys cryptomining software designed to consume system resources for illicit cryptocurrency mining. In some cases, additional malware components are installed to maintain long-term access.

Researchers have also observed the botnet removing competing malware from infected systems. This behavior ensures exclusive control over compromised servers and maximizes the attacker’s profits.

Scope of Exposure and Risk

A large number of Next.js servers remain exposed due to delayed patching or misconfigured deployments. Automated botnets like RondoDox are able to exploit these systems rapidly once scanning identifies a vulnerable target.

The scale of the campaign demonstrates how popular development frameworks can become high-value targets when critical flaws emerge.

Mitigation and Defensive Measures

Organizations running Next.js applications should immediately apply all available security updates related to React Server Components. Reducing internet exposure, restricting server-side endpoints, and monitoring for unusual process activity can further reduce risk.

Network-level protections and runtime monitoring also help detect exploitation attempts before malware deployment completes.

Conclusion

The RondoDox botnet campaign shows how dangerous unauthenticated remote code execution flaws can be when combined with automated exploitation. By abusing the React2Shell vulnerability, attackers are able to compromise Next.js servers at scale and deploy malicious payloads with minimal effort.

The incident reinforces the need for rapid patching, strict exposure controls, and continuous monitoring in modern web application environments.