The Dysphoria botnet has already compromised nearly 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. The infrastructure is used primarily for DDoS attacks and has recently added residential proxy functionality.
Researchers began tracking the threat in the first quarter of 2026. It evolved rapidly from the jackskid and fbot malware families. On peak days, up to 239,000 infected devices were observed active outside China.
Propagation relies mainly on brute-force attacks against Telnet and SSH services protected by weak passwords. The botnet also exploits known remote code execution vulnerabilities in IoT devices.
One of the most notable developments is the use of domains based on the Ethereum and Solana networks to locate command-and-control servers. This approach complicates infrastructure takedowns and allows operators to rotate addresses quickly.
Compromised devices can act as intermediate nodes. The malware uses UPnP to open ports on home routers, turning residential connections into relays that conceal the origin of malicious traffic.
Operators publicly advertise attack capacity of up to 4 Tbps and offer multiple DDoS service packages, indicating a structured commercial operation. Observed targets include internet service providers and gaming platforms across various countries.
