[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCZNxiEffg9VoAFa3Wv_uBDOa1cYB2eJeBqr8wyxuKOw":3},{"article":4,"iocs":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":25,"category":26,"article_tags":30},"89606161-ad5b-4a09-b3bc-0df9e6dc2d78","New Dysphoria DDoS botnet spreads to 200k devices worldwide","new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide-307824","A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]","A new botnet named Dysphoria has infected approximately 200,000 devices worldwide, leveraging them for distributed denial of service (DDoS) attacks and traffic relay operations. Evolving from older malware, Dysphoria employs a novel blockchain-based C2 resolution mechanism using Ethereum ENS and Solana SNS domains, making it difficult to trace. The botnet spreads via weak Telnet\u002FSSH credentials and exploits known vulnerabilities in routers and IoT devices, including several recent CVEs.","Dysphoria botnet infects 200k devices globally, using them for DDoS attacks and traffic relay.","New Dysphoria DDoS botnet spreads to 200k devices worldwide By Bill Toulas July 27, 2026 05:08 PM 0 A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the ‘jackskid’ and ‘fbot' malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism. Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm. The researchers first spotted Dysphoria on March 25 and identified multiple iterations that added meaningful updates, such as a C2 acquisition algorithm, multi-chain support, new domains, and functional separation between the relaying and DDoS variants. “Since the first quarter of 2026, XLAB has continuously tracked an emerging botnet family named Dysphoria, whose bot count exceeds 200,000,” reads XLab's report. “In just a few months, the family has undergone frequent variant updates and technical iterations, demonstrating extremely strong resilience.” The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle. Based on the researchers' analysis, infected clients send a fixed 78-byte login and heartbeat packet back to the C2 and receive from the operator DDoS attack commands that include duration, type, targets, and configurable flags. DDoS attack commandSource: XLAB In late June, XLab observed a variant that focused only on transforming infected devices into network proxies, and completely discarded the DDoS functionality. The malware abuses UPnP (Universal Plug and Play) on the compromised device to create 155 port forwarding rules to expose internal services to inbound internet connections. XLab's report notes that the botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and various IoT devices. Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys). However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek). XLab monitored the botnet between July 14 and 20 and recorded a peak of 740,000 daily pings from infected hosts, 239,000 connections from overseas clients, and 1,800 from China. The researchers confidently estimate that the number of infected devices is around 200,000 at this time. Concerning the botnet’s firepower, its operators claim a maximum DDoS capacity of 4 Tbps on their clearnet site, which promotes the service as a legitimate stress-tester. Dysphoria service websiteSource: BleepingComputer Despite being significantly lower than the current record figure of 31.4 Tbps achieved by the Aisuru\u002FKimwolf botnet in December 2025, it is still enough to cause notable disruptions. Users can protect against botnet infections by keeping their devices’ firmware up to date, changing the default administrator password, disabling remote access if not necessary, and strengthening the security settings where available\u002Fpossible. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: AryStinger botnet infected thousands of D-Link routers worldwideChina-linked JDY botnet expands targeting of U.S. military networksC0XMO botnet spreads via DD-WRT router flaw, kills rival malwareDutch govt disrupts malware botnet with 17 million infected devicesMalicious 7-Zip site distributes installer laced with proxy tool","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F27\u002Fbotnet.jpg","2026-07-27T21:08:15+00:00","2026-07-27T22:00:18.362586+00:00",8,[18,21,23],{"name":19,"type":20},"Ethereum ENS","technology",{"name":22,"type":20},"Solana SNS",{"name":24,"type":20},"UPnP","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50,53,56,59],{"type":45,"value":46,"context":47},"cve","CVE-2025-55182","Exploited vulnerability by Dysphoria",{"type":45,"value":49,"context":47},"CVE-2025-34152",{"type":45,"value":51,"context":52},"CVE-2025-28137","Exploited vulnerability by Dysphoria (Totolink)",{"type":45,"value":54,"context":55},"CVE-2025-9528","Exploited vulnerability by Dysphoria (Linksys)",{"type":45,"value":57,"context":58},"CVE-2017-17215","Exploited vulnerability by Dysphoria (Huawei)",{"type":45,"value":60,"context":61},"CVE-2020-8515","Exploited vulnerability by Dysphoria (DrayTek)"]