Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes

Dysphoria has turned a large number of everyday internet-connected devices into a potential attack network.

The botnet is linked to roughly 296,000 compromised devices, placing routers, cameras, gateways, and other connected equipment at risk of being used against targets chosen by its operators.

The scale matters because these devices often sit quietly at homes and small businesses.

Once controlled, they can generate traffic in a coordinated distributed denial-of-service, or DDoS, attack, making a website or online service difficult to reach.

The same access can also give criminals a way to route their own traffic through an unsuspecting victim’s connection.

Analysts at Shadowserver noted the activity in a critical special report that records the compromised-device dataset.

Shadowserver said in a report shared with Cyber Security News (CSN) that Dysphoria’s primary apparent role is DDoS activity and that it has recently added residential proxy functionality.

The finding shows how an exposed device can create problems beyond its owner’s network.

A single infected camera may seem minor, but hundreds of thousands of devices responding together can create a substantial pool of traffic, while proxy access can make malicious activity harder to trace to its real source.

Dysphoria Botnet Turns Compromised Routers

Dysphoria targets internet-of-things, or IoT, equipment, a broad category that includes routers, security cameras, gateways, and embedded Linux devices.

The result is an attacker-controlled group of machines called a botnet. Each device can wait for instructions, then send a portion of the traffic required for a DDoS attack.

The attack traffic comes from many normal-looking residential connections, complicating mitigation.

This model resembles other campaigns that have repurposed consumer equipment, including an AryStinger router proxy network. Dysphoria’s reported scale and its proxy capability expand the value of each infected device.

Shadowserver classified every event in its special dataset as critical.

Its records can include the affected IP address, observed port and protocol, location and network details, device vendor and model where available, and first- and last-seen times.

The report does not name a single exploit, password, or malware file responsible for the compromises.

Organizations should therefore avoid assuming one remediation step is enough, particularly when they manage mixed fleets of old cameras, routers, and other connected equipment.

DDoS Capacity Meets Residential Proxy Access

Residential proxy functionality changes the risk from simple disruption to potential concealment. Instead of only directing infected devices to flood a victim, operators may pass their own connections through those devices.

To an outside service, the activity can appear to originate from ordinary household or small-office internet addresses rather than from the operator’s infrastructure.

That approach has become a recurring concern in threats involving consumer hardware.

A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised.

Administrators should therefore treat externally exposed management services as a priority for review.

Owners should install supported firmware updates, replace default and weak administrator passwords, and disable remote administration unless it is necessary.

They should also place cameras and similar devices on a separate network where possible, restrict access to management interfaces, and replace equipment that no longer receives security updates.

Network operators receiving the special report should investigate listed systems promptly, using the last-seen field to understand how recently activity was observed.

They can isolate suspect devices, check account and configuration changes, update or replace the hardware, and monitor for renewed outbound traffic.

Related reporting on a TuxBot IoT DDoS framework underscores why broad device inventories and timely patching remain essential.

Dysphoria’s reported reach is a reminder that routers and cameras are not passive appliances when they are connected to the public internet.

They are computers with network access, and when they are left exposed or unmanaged, they can be turned into tools for outages and anonymity.

Prompt cleanup helps protect both the device owner and the wider internet, as the threat is widespread.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world