Dysphoria Botnet Hijacks 296,000 Routers and Cameras for DDoS and Proxy Abuse

The Dysphoria botnet has compromised about 296,000 internet-connected devices, largely routers, cameras, gateways, and other embedded Linux or IoT systems, and is being used to launch distributed denial-of-service (DDoS) attacks while also relaying attacker traffic through infected hosts. Reporting citing Shadowserver says the botnet has expanded beyond disruption to include residential proxy functionality, allowing malicious traffic and command-and-control relay activity to appear as if it originates from ordinary home or small-business internet connections.

The exposed population reflects devices that are already compromised, rather than victims of a single confirmed exploit chain, and prior reporting linked Dysphoria infections to Telnet and SSH password attacks alongside exploitation of known vulnerabilities. Defenders are being urged to investigate exposed management services, update firmware, replace weak or reused credentials, disable unnecessary remote administration, segment IoT devices from critical networks, and retire unsupported hardware that can no longer be secured.