The Dysphoria botnet has expanded into a major Internet of Things threat, with a new Shadowserver Special Report identifying approximately 296,000 compromised devices.
The campaign targets exposed routers, gateways, IP cameras and other embedded Linux systems, converting poorly secured equipment into a distributed platform for DDoS attacks and increasingly, residential proxy and relay operations.
Dysphoria’s scale is significant because it draws on device categories that are often deployed outside conventional endpoint-management programs.
Consumer routers, DVRs, cameras and small-office gateways commonly remain internet-facing for years, run outdated firmware, expose Telnet or SSH, and retain weak or default credentials.
Research has linked the operation to exploitation of a broad set of known flaws affecting routers, gateways, cameras, repeaters and embedded Linux products, alongside weak Telnet and SSH authentication.
Shadowserver’s new dataset, covering roughly 296,000 affected devices, indicates that the exposure is broader and provides defenders with a substantially larger remediation target.
The report categorizes every event as CRITICAL, emphasizing the risk that an infected device can be remotely tasked to participate in volumetric attacks, conceal command-and-control infrastructure, or relay malicious traffic through a victim network.
What distinguishes Dysphoria from a conventional IoT DDoS botnet is its resilience architecture. The malware uses blockchain-backed naming systems, including Ethereum Name Service and Solana Name Service, to resolve command-and-control infrastructure.
Unlike an ordinary DNS domain, a blockchain name can complicate seizure and infrastructure disruption because operators can alter associated records without relying on a traditional registrar-hosting workflow.
Shadowserver Researchers said that, Dysphoria operators exploit that operational gap through password guessing and known remote-code-execution vulnerabilities, allowing vulnerable systems to be silently enrolled into the botnet.
Early reporting placed Dysphoria’s active population above 200,000 devices, with researchers observing a single-day overseas peak of 239,000 bots.
Researchers also observed infected devices being used as intermediaries, keeping the actual controller separated from bots and frustrating attempts to identify the backend infrastructure from victim-side traffic.
Dysphoria Hijacks Routers
The botnet’s newer relay-focused functionality raises the stakes. A variant captured in late June reportedly removed DDoS attack code and instead operated solely as a proxy node.
It scans the local network for Universal Plug and Play-capable gateways, then attempts to create inbound access through router port mapping.
Researchers observed the malware opening port 155 in this process, enabling an external client to traverse an infected host and reach another destination.
This turns compromised residential and small-business devices into an on-demand proxy layer, potentially useful for anonymizing malicious activity, bypassing IP-based restrictions, or hiding C2 servers behind victim-owned addresses.
For network defenders, the Shadowserver Special Report is designed as a retrospective, high-value notification rather than a normal 24-hour daily report.
Its distribution timestamp is set to August 12, 2026, but the last_seen_time field provides the precise most-recent observation for each affected IP.
The dataset includes IP address, port, protocol, ASN, geographic data, device vendor, model, firmware version, first- and last-seen times, exposure duration, user agent and infection tag.
That context should help ISPs, national CSIRTs, enterprises and managed-service providers prioritize remediation and identify recurring exposure patterns.
Immediate response should include isolating suspected devices, changing all administrative, Telnet and SSH credentials, disabling unnecessary remote administration and UPnP, applying vendor firmware updates, and replacing equipment that has reached end of life.
Teams should also inspect router port-forwarding rules and investigate unexplained outbound connections or traffic relays.
Shadowserver’s reporting program distributes actionable network data to vetted subscribers, and organizations that missed the Dysphoria alert can request recent Special Reports after subscribing their networks.
Dysphoria demonstrates that IoT compromise is no longer limited to brute-force-driven DDoS capacity.
Its evolution into a decentralized relay and residential-proxy ecosystem makes every unpatched edge device a potential asset for attackers and a liability for the network that owns it.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
