Analysis of RondoDox and IoT Botnet Scanning Activity

Analysis of honeypot telemetry from May to June 2026 reveals a tiered ecosystem of automated cybercrime, ranging from poorly executed commodity botnets to sophisticated enterprise-targeting campaigns. While actors like TerraBot and r00ts3c focus on legacy IoT vulnerabilities in D-Link, Linksys, and MVPower devices, the RondoDox botnet demonstrates higher technical maturity by targeting Log4Shell (CVE-2021-44228) and AI frameworks (ShadowRay, CVE-2023-48022).

The investigation highlights a shift in operational tradecraft where RondoDox utilized compromised residential routers in New Zealand to conduct multi-phase scanning. This residential drift allows attackers to bypass reputation-based filtering and maintain persistence through standard DHCP lease cycles. Despite the sophistication of RondoDox, commodity actors like TerraBot continue to struggle with basic engineering errors, such as unencoded characters that trigger HTTP 400 errors, yet remain a persistent threat due to high-volume automation.