RondoDox botnet expands arsenal targeting 174 flaws, and hits 15,000 daily exploit attempts

Security Affairs

March 17, 2026 at 3:01 PM

Actively Exploited

Overview

The RondoDox botnet is ramping up its activities, now targeting 174 different vulnerabilities with an alarming rate of 15,000 exploitation attempts each day. This more focused campaign signals a strategic shift in how the botnet operates, making it a significant concern for cybersecurity experts. Organizations and individuals who use software with these vulnerabilities are at heightened risk of being attacked. The botnet's ability to exploit these flaws could lead to unauthorized access, data breaches, and other serious security incidents. As researchers continue to monitor this situation, it's crucial for affected users to take preventive measures and patch their systems promptly.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: 174 vulnerabilities across various software and systems
Action Required: Users should apply the latest security patches and updates from their software vendors to mitigate these vulnerabilities.
Timeline: Ongoing since recent months

Original Article Summary

RondoDox botnet targets 174 flaws, reaching 15,000 daily exploit attempts in a more focused and strategic campaign. RondoDox botnet is ramping up attacks, targeting 174 vulnerabilities with up to 15,000 daily exploitation attempts in a more focused and strategic campaign, Bitsight reported. “We gathered all these exploit attempts (identifiable by indicators like the User-Agent and […]

Impact

174 vulnerabilities across various software and systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since recent months

Remediation

Users should apply the latest security patches and updates from their software vendors to mitigate these vulnerabilities. Regularly updating systems and conducting vulnerability assessments are also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Patch, Botnet.

Read Original Article

Related Coverage

Europe sanctions Chinese and Iranian firms for cyberattacks

BleepingComputer

The European Union Council has imposed sanctions on three Chinese and Iranian firms, along with two individuals, due to their involvement in cyberattacks aimed at critical infrastructure in Europe. These actions come as a response to increasing concerns over cyber threats that target essential services and systems, which could potentially disrupt daily life and national security. The sanctions serve as a warning to other entities that engage in similar malicious activities. This incident underscores the ongoing geopolitical tensions surrounding cybersecurity and the measures governments are willing to take to protect their infrastructures. The names of the sanctioned entities have not been disclosed, but the EU's firm stance indicates a commitment to countering cyber threats collaboratively.

Mar 17, 2026

Android OS-Level Attack Bypasses Mobile Payment Security

Infosecurity Magazine

Researchers have discovered a serious vulnerability in Android that allows attackers to hijack mobile payment applications using a technique called LSPosed-based runtime manipulation. This attack can bypass security measures such as SIM binding, which is intended to protect users' financial transactions. As a result, anyone using affected payment apps could be at risk of fraud and unauthorized transactions. This incident highlights the ongoing challenges in mobile security, especially for users who rely on their devices for financial activities. Users should be cautious and consider reviewing their app security settings until further protections are implemented.

Mar 17, 2026

UK Companies House Exposed Details of Millions of Firms

SecurityWeek

The UK Companies House has acknowledged a security vulnerability that potentially exposed sensitive details of millions of businesses. This flaw could allow unauthorized individuals to access company information and modify official records. The agency has confirmed that the issue could have serious implications for the integrity of business data in the UK, raising concerns about identity theft and fraud. As Companies House holds critical information about registered companies, this exposure poses a significant risk to both businesses and consumers. Authorities are urging companies to remain vigilant and review their security practices in light of this breach.

Mar 17, 2026

Warlock Ransomware Group Augments Post-Exploitation Activities

darkreading

The Warlock Ransomware Group has recently enhanced its operations by using a new technique called BYOVD, which allows them to conduct stealthier activities across networks. This technique, combined with other tools, enables the group to exploit systems more effectively and avoid detection. The implications of this development are significant, as it suggests that organizations may be at greater risk of ransomware attacks that can spread quickly across their networks. Companies should be vigilant and ensure their security measures are robust enough to counter these evolving tactics. Users need to stay informed about such threats to protect their data and systems.

Mar 17, 2026

'CursorJack’ Attack Path Exposes Code Execution Risk in AI Development Environment

Infosecurity Magazine

Researchers have identified a security vulnerability called 'CursorJack' that affects the Cursor IDE, a development environment used for coding, particularly in AI projects. This flaw allows attackers to exploit malicious deeplinks, which can lead to unauthorized code execution if users inadvertently approve these links. The risk is significant because it can compromise the integrity of the code being developed, potentially leading to the introduction of harmful code into applications. Developers using the Cursor IDE should be aware of this vulnerability and take precautions to avoid falling victim to such attacks. The implications extend beyond individual users, as compromised code could lead to broader security issues in applications that rely on this development environment.

Mar 17, 2026

Top 5 Things CISOs Need to Do Today to Secure AI Agents

BleepingComputer

The article emphasizes the need for Chief Information Security Officers (CISOs) to take immediate action to secure AI agents, which are increasingly being integrated into business processes. It stresses the importance of identity-based access control to prevent unauthorized use and potential data breaches. This is particularly relevant as AI agents operate autonomously and can access sensitive data and systems. By implementing strong access controls, organizations can mitigate risks associated with misuse and data exposure. As AI technology continues to evolve, ensuring its security is crucial for protecting both company assets and customer information.

Mar 17, 2026