A Special Report has identified approximately 296,000 internet-connected devices compromised by the Dysphoria botnet, marking a major expansion of an IoT threat already associated with distributed denial-of-service attacks and residential proxy operations.
The report classifies every listed event as critical, providing affected-network operators with retrospective data to identify and remediate exposed devices.
Dysphoria primarily targets internet-facing IoT systems, including routers, cameras, gateways, DVRs, and other embedded Linux devices.
Earlier variants focused on building a DDoS-capable botnet, while newer versions also convert victims into relay infrastructure that can carry attacker-controlled traffic.
Researchers have observed a relay-only variant that removes DDoS functionality and instead turns compromised hosts into proxy nodes.
The 296,000-device figure represents a significant operational concern because each infected endpoint can be used both as an attack participant and as a source of seemingly residential or small-business network traffic.
This can allow malicious operators to hide their origin, bypass IP-based restrictions, conduct automated abuse, or relay traffic through legitimate broadband connections.
Dysphoria Botnet Hijacks IoT
Dysphoria’s evolution illustrates how IoT botnets are becoming more flexible. Traditional botnets use infected devices to flood targets with traffic.
In contrast, Dysphoria can support DDoS operations while also establishing a distributed proxy layer across compromised networks.
The malware has been linked to weak Telnet and SSH credentials and known remote-code-execution flaws affecting vulnerable IoT hardware.
Devices with default passwords, unpatched firmware, exposed management interfaces, or unnecessary remote-access services are at elevated risk.
The newer relay capability is especially notable because it can make a compromised device useful even when it is placed behind network address translation (NAT).
Researchers reported that Dysphoria abuses Universal Plug and Play (UPnP) to create port-forwarding rules, potentially mapping up to 155 ports.
That behavior exposes internal devices or services to inbound connections and enables attackers to use the infected host as an externally reachable relay.
Dysphoria also uses a more resilient command-and-control design than many conventional IoT botnets. Reports indicate that operators have used Ethereum Name Service and Solana Name Service records to help bots locate control infrastructure.
This blockchain-based approach can complicate disruption efforts because defenders cannot rely only on blocking a small set of conventional domains or IP addresses.
Shadowserver distributed the dataset as a Special Report rather than a standard daily network report. Unlike its usual reporting model, this one-time dataset does not represent activity from a single 24-hour window.
It is intended to provide network owners with valuable retrospective visibility after investigators have analyzed the available data, shadowserver said.
The report uses 2026-08-12 00:00:00 as the timestamp for individual entries because exact event timestamps were not available.
Defenders should instead use the last_seen_time field to determine when Dysphoria activity was last observed from a specific IP address.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
