Dysphoria Botnet Compromises Nearly 300,000 IoT Devices in Major Expansion A recent report has uncovered a significant surge in activity from the Dysphoria botnet, which has compromised approximately 296,000 internet-connected IoT devices worldwide. The malware, known for its dual functionality, now poses a heightened threat by enabling both distributed denial-of-service (DDoS) attacks and residential proxy operations, allowing attackers to mask their origins and abuse legitimate network infrastructure. Dysphoria primarily targets vulnerable IoT systems, including routers, cameras, gateways, DVRs, and embedded Linux devices. Early variants focused on DDoS capabilities, but newer versions have evolved to convert infected hosts into proxy relay nodes, removing DDoS functionality in some cases. This shift allows compromised devices to serve as traffic relays, enabling attackers to bypass IP-based restrictions, conduct automated abuse, or blend malicious activity with residential or small-business network traffic. The botnet exploits weak Telnet and SSH credentials, unpatched firmware, exposed management interfaces, and unnecessary remote-access services. Notably, Dysphoria leverages Universal Plug and Play (UPnP) to create port-forwarding rules, exposing internal devices to inbound connections and enabling attackers to use infected hosts as externally reachable relays even behind network address translation (NAT). A key concern is Dysphoria’s resilient command-and-control (C2) infrastructure, which uses Ethereum Name Service (ENS) and Solana Name Service (SNS) records to help bots locate control servers. This blockchain-based approach complicates mitigation efforts, as defenders cannot rely solely on blocking traditional domains or IP addresses. The dataset, released as a Special Report by Shadowserver, provides retrospective visibility for affected network operators. Unlike standard daily reports, this one-time release aggregates historical data rather than a single 24-hour snapshot. While entries are timestamped August 12, 2026, defenders are advised to use the last_seen_time field to track recent activity from specific IP addresses. The expansion of Dysphoria underscores the growing sophistication of IoT botnets, which are increasingly used for both disruptive attacks and covert proxy operations, amplifying the risks for organizations and residential networks alike.

FBI Warns of Widespread BADBOX 2.0 Malware Infections Targeting Home IoT Devices The FBI has issued an alert regarding BADBOX 2.0, a sophisticated malware campaign compromising over 1 million internet-exposed home devices, primarily manufactured in China. The malware, downloaded during device setup, enables attackers to establish residential proxy networks, conduct credential stuffing attacks, and execute ad fraud. Compromised devices may exhibit deactivated Google Play Protect settings or unusual internet traffic, prompting the FBI to recommend immediate isolation and restricted network access. Users are advised to monitor network activity, download apps exclusively from official stores, and keep devices updated to mitigate risks. The advisory follows recent disclosures of other cyber threats, including the New Cosmali Loader, which infects Windows systems via typosquatted Microsoft Activation Scripts domains using malicious PowerShell scripts. Additionally, the Shai Hulud malware campaign has impacted over 25,000 repositories and hundreds of npm packages, automating developer environment compromises. Efforts to disrupt BADBOX 2.0 involved collaboration between the FBI, Google, Trend Micro, and the Shadowserver Foundation, while tools like Nezha—a post-exploitation remote access trojan—help attackers evade detection by blending with legitimate activity.