Reported by 3 outlets

Timeline

1. original reporting

   Dysphoria Hijacks Routers, Gateways and IP Cameras to Build Massive IoT Botnet

   gbhackers.com · 60d ago · August 14th, 2026

   The Dysphoria botnet has expanded into a major Internet of Things threat, with a new Shadowserver Special Report identifying approximately 296,000 compromised devices. The campaign targets exposed routers, gateways, IP cameras and other embedded Linux systems, converting poorly secured equipment into a distributed platform for DDoS attacks and increasingly, residential proxy and relay operations. Dysphoria’s […] The post Dysphoria Hijacks Routers, Gateways and IP Cameras to Build Massive IoT Botnet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from bleepingcomputer.com

   Dysphoria DDoS Botnet Reaches 200,000 Devices with Blockchain-Based C2

   bleepingcomputer.com · 78d ago · July 28th, 2026

   A botnet called Dysphoria has compromised approximately 200,000 devices globally and is being used for DDoS attacks and traffic relay operations, according to QiAnXin XLab researchers. Key technical details:

   • Evolved from JackSkid and FBot malware families

   • Uses Ethereum ENS and Solana SNS domains for covert C2 resolution

   • C2 addresses hidden inside fake IPv6 strings, recovered via custom byte-transformation algorithm

   • First spotted March 25, 2026; has undergone multiple rapid variant updates

   • Functional separation between DDoS variants and relay variants

   • Use of blockchain infrastructure makes takedown significantly harder than traditional DNS-based botnets

   Hunting hypothesis: Monitor for unusual ENS/SNS DNS queries from endpoints that should not be resolving blockchain domains. Investigate devices with anomalous outbound traffic on non-standard ports.

3. update from cyberpress.org

   Dysphoria Botnet Compromises 296,000 IoT Devices for DDoS and Residential Proxy Operations

   cyberpress.org · 60d ago · August 14th, 2026

   The report classifies every listed event as critical, providing affected-network operators with retrospective data to identify and remediate exposed devices. Earlier variants focused on building a DDoS-capable botnet, while newer versions also convert victims into relay infrastructure that can carry attacker-controlled traffic. Researchers have observed a relay-only variant that removes DDoS functionality and instead turns compromised hosts into proxy nodes. The 296,000-device figure represents a significant operational concern because each infected endpoint can be used both as an attack participant and as a source of seemingly residential or small-business network traffic. This can allow malicious operators to hide their origin, bypass IP-based restrictions, conduct automated abuse, or relay traffic through legitimate broadband connections. Dysphoria Botnet Hijacks IoT Dysphoria’s evolution illustrates how IoT botnets are becoming more flexible. In contrast, Dysphoria can support DDoS operations while also establishing