Dysphoria Botnet Infects 200,000 IoT Devices and Hides C2 Behind Blockchain Domains

Cybersecuritynews •Tushar Subhra Dutta • July 28, 2026

Dysphoria has emerged as a fast-moving IoT botnet that has infected an estimated 200,000 devices worldwide. The malware targets routers, cameras, gateways, and other embedded Linux systems, turning poorly protected equipment into resources for cybercriminal operations. Its operators use a mix of Telnet and SSH password attacks alongside known software flaws to gain access. This […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dysphoria Botnet Infects 200,000 Devices Using Blockchain for C2 Operations The Dysphoria botnet has compromised approximately 200,000 devices globally, utilizing a sophisticated command-and-control (C2) infrastructure hidden behind Ethereum and Solana blockchain domains. Originating from the jackskid and fbot malware, it targets IoT devices such as routers and cameras by exploiting weak Telnet and SSH credentials as well as known vulnerabilities like CVE-2020-8515 and CVE-2025-55182. The botnet's operators have demonstrated resilience through frequent updates and iterations, with a peak of 740,000 daily pings recorded. The malware can execute DDoS attacks with a claimed capacity of 4 Tbps, posing a significant risk for disruptions. Researchers from QiAnXin XLab and CNCERT are actively monitoring the botnet's activities and recommend device firmware updates as a preventive measure. 4 sources 71

Extracted Entities

Dysphoria Botnet Infects 200,000 IoT Devices and Hides C2 Behind Blockchain Domains

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)