Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes

Cybersecuritynews •Tushar Subhra Dutta • August 14, 2026

Dysphoria has turned a large number of everyday internet-connected devices into a potential attack network. The botnet is linked to roughly 296,000 compromised devices, placing routers, cameras, gateways, and other connected equipment at risk of being used against targets chosen by its operators. The scale matters because these devices often sit quietly at homes and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dysphoria Botnet Compromises 296,000 IoT Devices for DDoS Attacks The Dysphoria botnet has compromised approximately 296,000 Internet of Things devices, including routers, gateways, and IP cameras. This botnet is exploiting poorly secured embedded Linux systems, converting them into a platform for Distributed Denial of Service (DDoS) attacks and residential proxy operations. The scale of the botnet poses a significant threat as these devices are often located in residential areas, making them less monitored. The Shadowserver Special Report has identified the extent of the compromise, emphasizing the urgent need for improved security measures on IoT devices. The botnet's operators are leveraging these compromised devices to target various online entities. As of now, the botnet remains active and poses ongoing risks to internet infrastructure. 2 sources 67

Extracted Entities

Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)