A malware operation has taken control of around 200,000 devices worldwide, and most of their owners have no idea. Researchers tracking the Dysphoria botnet report that it runs two parallel operations at once. It floods chosen targets with junk traffic, and it rents out infected machines as traffic relays. Home routers, IP cameras and other connected gadgets make up the bulk of that army.
The scale matters, but the method matters more. This malware family borrows infrastructure tricks from cryptocurrency networks to stay online, so ordinary takedown tactics struggle against it. For anyone who cares about privacy, the proxy side of the operation deserves closer attention than the attack side.
What the Dysphoria botnet actually does
Security researchers first spotted the malware on 25 March 2026, and it has changed repeatedly since. Early versions focused on distributed denial of service attacks, better known as DDoS. In that model, thousands of infected devices hit one website at the same time. The server then collapses under the load, while the device owner notices nothing beyond a slightly sluggish connection.
Each infected machine keeps a steady line open to its operators. It sends a fixed 78 byte packet that works as both a login and a heartbeat signal. In return, it receives instructions naming the target, the attack type and the duration. Configurable flags fine tune the rest.
The code did not appear from nowhere. It grew out of two older malware families known as jackskid and fbot, then added a fresh layer of concealment on top.
Blockchain domains keep the command servers alive
That concealment layer is the genuinely novel part. The malware avoids hardcoded IP addresses and standard domain names. Instead, it looks up its instructions through Ethereum ENS and Solana SNS records. These blockchain naming systems work like DNS, but a public ledger holds the records rather than a company server.
The addresses arrive disguised as fake IPv6 strings. A custom byte transformation algorithm converts them back into usable server addresses once the malware retrieves them. Anyone inspecting the traffic sees what looks like harmless network noise.
Why does this matter so much? Ordinary botnet takedowns work by seizing domains or pressuring hosting providers. No registrar can revoke a blockchain record, so the operators rotate their infrastructure freely. Researchers describe the Dysphoria botnet as unusually resilient for exactly that reason. Several variants have already shipped with multi chain support and new domains.
Weak passwords and years old flaws open the door
Getting in requires no sophistication at all. The malware scans for exposed Telnet and SSH services, then tries common credential pairs until something works. Default administrator passwords remain the most reliable way in.
Beyond that, it exploits a mix of new and ancient vulnerabilities:
- CVE-2025-55182, the flaw nicknamed React2Shell
- CVE-2025-34152
- CVE-2025-28137, affecting Totolink devices
- CVE-2025-9528, affecting Linksys hardware
- CVE-2017-17215, a Huawei router flaw from 2017
- CVE-2020-8515, a DrayTek flaw from 2020
Two of those bugs are more than five years old. Patches exist for both, yet enough unpatched hardware sits online to keep them worth exploiting. Consumer routers rarely update themselves, and many people never open the admin panel again after setup day.
The proxy pivot puts your IP address on the line
In late June, researchers watched the Dysphoria botnet do something new. One variant dropped the DDoS code entirely and focused purely on turning infected devices into network proxies. That change shifts the risk profile for ordinary users in a serious way.
A proxy node passes someone else’s traffic through your internet connection. Whatever that traffic contains, it leaves your IP address in the logs of every site it touches. Criminal groups pay well for residential IP addresses because they look legitimate to fraud detection systems. Credential stuffing, scraping and account takeover attempts all travel more convincingly through a real home connection.
So a compromised router becomes a legal liability rather than a simple nuisance. You never sent that traffic, yet the address attached to it belongs to you.
UPnP makes the problem worse
The proxy variant abuses UPnP, the feature that lets devices open ports on your router automatically. It creates 155 port forwarding rules in a single sweep. Internal services that should never face the internet suddenly accept inbound connections from anywhere. Switching UPnP off closes that particular door.
How much firepower does it have
The people running the Dysphoria botnet advertise their service on a public website. They market it as a legitimate stress testing tool and claim a maximum output of 4 Tbps. Monitoring between 14 and 20 July recorded a peak of 740,000 daily pings from infected hosts. Overseas clients accounted for 239,000 connections, with another 1,800 coming from inside China.
Four terabits per second falls well short of the current record. The Aisuru and Kimwolf operation hit 31.4 Tbps back in December 2025. Still, that capacity can flatten a mid sized hosting provider, a game server or a regional news site. Smaller targets have no realistic defence against it.
Keeping your devices out of the Dysphoria botnet
Home users have more control here than they might expect. A few habits close off most of the infection routes used by the Dysphoria botnet.
- Change the default administrator password on every router, camera and network device
- Install firmware updates, and check manually if your device offers no automatic option
- Disable remote administration unless you actively need it
- Turn off UPnP and open ports by hand when a service requires them
- Replace hardware that no longer receives security updates from its manufacturer
A VPN protects the traffic leaving your devices, but it cannot clean malware already running on a router. Use both approaches together. Harden the hardware first, then encrypt what travels across it.
Final Thoughts
Botnets built on consumer hardware succeed because that hardware stays online and unattended for years. The Dysphoria botnet fits the pattern precisely. Its blockchain based command system also makes disruption harder than it was even two years ago, so enforcement action will take time, if it comes at all.
Until then, the practical defence sits with device owners. Ten minutes in a router admin panel removes most of the weaknesses this malware relies on. Given how fast the Dysphoria botnet has grown since March, that small effort looks like a reasonable trade.
