A new botnet called Dysphoria has quietly compromised around 200,000 routers, cameras, and other internet-connected devices and is renting their bandwidth for distributed denial-of-service attacks and traffic relay services. Researchers at QiAnXin XLab who tracked it between July 14 and 20 recorded a peak of 740,000 daily pings from infected devices. The botnet emerged from the wreckage of JackSkid, one of the IoT botnets disrupted by U.S., Canadian, and German authorities earlier this year, and has grown quickly in the months since.
What makes Dysphoria harder to shut down than earlier botnets is its use of blockchain to hide its infrastructure. The operators register command-and-control addresses through Ethereum ENS and Solana SNS domains, embedding server addresses inside fake IPv6 strings decoded by a custom algorithm — a technique that makes traditional domain-seizure takedowns far less effective. The botnet spreads by targeting devices with weak or default Telnet and SSH credentials, along with known vulnerabilities in common consumer hardware: routers from Totolink (CVE-2025-28137), Linksys (CVE-2025-9528), Huawei (CVE-2017-17215), and DrayTek (CVE-2020-8515) are among the exploited models. The operators advertise a maximum DDoS capacity of 4 Tbps and market the botnet as a “stress-tester” on a public clearnet site.
How to check if you’re affected
Affected devices include routers, IP cameras, and other IoT hardware running outdated firmware versions — particularly models from Totolink, Linksys, Huawei, and DrayTek that have not received recent security patches. Check your router’s admin panel for the current firmware version and compare it against the manufacturer’s latest release. Also change any default usernames and passwords, and disable remote Telnet or SSH access if you don’t need them. These two steps remove most of the infection surface for Dysphoria and similar botnets.