Loading story…
The Dysphoria botnet has compromised about 296,000 internet-connected devices, largely routers, cameras, gateways, and other embedded Linux or IoT systems, and is being used to launch distributed denial-of-service (DDoS) attacks while also relaying attacker traffic through infected hosts. Reporting citing Shadowserver says the botnet has expanded beyond disruption to include residential proxy functionality, allowing malicious traffic and command-and-control relay activity to appear as if it originates from ordinary home or small-business internet connections.
The exposed population reflects devices that are already compromised, rather than victims of a single confirmed exploit chain, and prior reporting linked Dysphoria infections to Telnet and SSH password attacks alongside exploitation of known vulnerabilities. Defenders are being urged to investigate exposed management services, update firmware, replace weak or reused credentials, disable unnecessary remote administration, segment IoT devices from critical networks, and retire unsupported hardware that can no longer be secured.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Shadowserver reported that Dysphoria has recently added residential proxy functionality, allowing operators to relay their own traffic through infected devices. This makes malicious traffic appear to come from ordinary residential or small-business internet connections, increasing attacker anonymity and complicating mitigation.
According to Shadowserver, Dysphoria's primary apparent role is distributed denial-of-service activity, with infected devices able to contribute coordinated attack traffic. The references describe this as a key use of the botnet's compromised IoT footprint.
Shadowserver reported a critical special dataset covering roughly 296,000 compromised devices tied to the Dysphoria botnet, primarily routers, cameras, gateways, and embedded Linux or IoT equipment. The dataset focuses on devices already observed as compromised rather than attributing all infections to a single exploit or malware file.
The references state that a previously reported Dysphoria IoT infection campaign used password attacks against Telnet and SSH alongside known vulnerabilities to compromise devices. No explicit date is provided for that earlier campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Momentum botnet** was observed compromising Linux-based internet-facing devices and using them to launch distributed denial-of-service attacks, with infections spanning routers, DVRs, web servers, GPON equipment, and other exposed services. Trend Micro reported that the malware targeted multiple CPU architectures, established persistence by modifying `rc` files, connected to IRC command-and-control infrastructure including the `#HellRoom` channel, and in one analyzed case deployed a **Mirai** backdoor while also using **Kaiten** and **Bashlite** variants in its broader operations. The activity was tied to exploitation of known router remote-code-execution weaknesses, including publicly disclosed flaws affecting **ZyXEL**, **Billion**, and **TrueOnline** devices, helping the operators expand a botnet that reportedly showed **1,232 victims** on an observed C2 server. Once enrolled, infected systems could be directed to carry out **36** attack methods, including `SYN`, `ACK`, `UDP`, `HTTP`, `LDAP`, `DNS`, `Memcache`, and Valve Source Engine amplification floods, while also supporting proxying, shell-command execution, and fast-flux techniques to keep command infrastructure resilient.
Aug 14, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
Security researchers reported that the **Reaper** IoT botnet, also tracked as **IoTroop**, was spreading by exploiting known vulnerabilities in Internet-connected routers and cameras instead of relying mainly on default passwords as **Mirai** did. Check Point said the malware had already compromised roughly **one million organizations**, while Netlab 360 described its scanning as more selective and stealthy than Mirai’s, raising concern that Reaper could assemble a significantly larger botnet for future **DDoS** attacks or other malicious operations. The malware was linked to exploits for at least nine published flaws affecting devices from vendors including **Linksys**, **Netgear**, **D-Link**, **AVTECH**, and products using vulnerable custom **GoAhead**-based camera software. Referenced weaknesses included older Linksys router vulnerabilities and severe camera flaws such as the **WIFICAM** issues assigned **`CVE-2017-8221`** through **`CVE-2017-8225`**, which enabled pre-authentication compromise and root-level code execution. Researchers warned that large numbers of exposed, unpatched IoT devices remained reachable from the Internet, creating conditions for another Mirai-scale disruption unless organizations rapidly patch, isolate, or replace affected systems.
Aug 15, 2026