Dysphoria Botnet Hijacks Routers, Cameras for DDoS Attacks and C2 Relays

Key Takeaways

• The Dysphoria botnet has compromised an estimated 296,000 internet-connected devices, including routers, cameras, and gateways.
• These compromised devices are being leveraged for Distributed Denial-of-Service (DDoS) attacks and to serve as residential proxy relays, obscuring the true origin of malicious traffic.
• The botnet primarily targets Internet of Things (IoT) equipment, often found in homes and small businesses, turning them into active participants in cybercrime.
• Shadowserver has classified all observed compromises as critical, emphasizing the severe risk posed by these hijacked devices.
• Mitigation requires addressing weak passwords, disabling unnecessary remote access, and ensuring all IoT devices are running updated firmware.

A new botnet, dubbed “Dysphoria,” has commandeered a substantial network of internet-connected devices, transforming them into a formidable infrastructure for launching Distributed Denial-of-Service (DDoS) attacks and establishing command-and-control (C2) relays. This widespread compromise, affecting an estimated 296,000 devices, highlights the persistent vulnerability of consumer-grade IoT equipment.

The sheer scale of the Dysphoria botnet is particularly concerning, as many of these affected devices operate silently within homes and small businesses. Once under the control of threat actors, these compromised routers, cameras, and other connected hardware can collectively generate overwhelming traffic, effectively rendering targeted websites or online services inaccessible. Furthermore, the same access allows criminals to funnel their illicit traffic through these unsuspecting victims’ internet connections, making attribution significantly more challenging.

Security researchers at Shadowserver detailed this alarming activity in a critical special report, meticulously cataloging the dataset of compromised devices. Shadowserver said in a report shared with Cyber Security News (CSN) that Dysphoria’s primary function appears to be orchestrating DDoS attacks, with recent observations indicating the addition of residential proxy capabilities. This dual functionality amplifies the threat, moving beyond mere disruption to enable greater anonymity for malicious operations.

The findings underscore how a single exposed device can cascade into a broader security threat, extending far beyond the owner’s immediate network perimeter. While an individual infected camera might seem insignificant, hundreds of thousands of such devices acting in concert can generate a massive volume of attack traffic. The added proxy access further complicates efforts to trace malicious activities back to their genuine sources.

Dysphoria Botnet Turns Compromised Routers

Dysphoria specifically targets a wide array of Internet of Things (IoT) equipment, encompassing common devices like residential routers, security cameras, network gateways, and various embedded Linux systems. The successful compromise of these devices creates a botnet, a network of attacker-controlled machines, each capable of receiving instructions and contributing to a DDoS attack by sending a portion of the required traffic.

A significant challenge in mitigating these attacks stems from the fact that the malicious traffic originates from a multitude of seemingly legitimate residential internet connections. This pattern mirrors other campaigns that have repurposed consumer hardware, such as the AryStinger router proxy network. Dysphoria’s reported size and its newfound proxy functionality substantially increase the operational value derived from each compromised device.

Shadowserver has assigned a critical severity rating to every event documented in its special dataset. Their records provide crucial details including the affected IP address, observed port and protocol, geographical location, network specifics, and, where available, the device vendor and model. The dataset also includes timestamps for when the device was first and last observed as compromised. This comprehensive data aids in understanding the scope and nature of the infections. For more technical details, refer to the full report: Dysphoria Botnet Turns Compromised Routers and Cameras Into DDoS Bots and C2 Relay Nodes.

The report does not pinpoint a single exploit, password, or malware file as the sole cause of these compromises. This suggests that a multifaceted approach to remediation is necessary, particularly for organizations managing diverse fleets of older cameras, routers, and other internet-connected devices.

DDoS Capacity Meets Residential Proxy Access

The integration of residential proxy functionality fundamentally alters the risk profile, expanding it from mere service disruption to potential anonymity for criminal activities. Instead of solely directing compromised devices to flood a target with traffic, the botnet operators can now route their own network connections through these hijacked devices. This tactic makes malicious activity appear to originate from ordinary household or small office internet addresses, effectively masking the operators’ true infrastructure.

This method of leveraging consumer hardware for illicit purposes is a recurring and escalating concern in the cybersecurity landscape. Prior reports indicated that Dysphoria’s IoT infection campaigns employed password attacks against Telnet and SSH services, alongside exploiting known vulnerabilities. The latest dataset focuses on devices already identified as compromised, reinforcing the urgency for administrators to prioritize the security of all externally exposed management services.

What You Should Do

• Update Firmware Regularly: Ensure all IoT devices, including routers, cameras, and gateways, are running the latest supported firmware versions.
• Change Default Credentials: Immediately replace all default and weak administrator passwords with strong, unique passwords for every device.
• Disable Remote Administration: Turn off remote administration features on devices unless absolutely necessary. If remote access is required, secure it with VPNs and strong authentication.
• Network Segmentation: Where feasible, isolate IoT devices such as cameras on a separate network segment or VLAN to limit their access to the main network.
• Restrict Management Interface Access: Configure firewalls and device settings to restrict access to management interfaces to trusted IP addresses only.
• Replace End-of-Life Equipment: Retire and replace any hardware that no longer receives security updates from the manufacturer.
• Investigate Compromised Systems: Network operators who receive special reports from Shadowserver should promptly investigate listed systems, prioritizing those with recent “last-seen” activity.
• Isolate and Monitor: Isolate any suspect devices, review account and configuration changes, update or replace the hardware, and actively monitor for renewed outbound malicious traffic.

The reported reach of Dysphoria serves as a stark reminder that routers and cameras, when connected to the public internet, are not passive appliances. They are sophisticated computing devices with network access, and when left exposed or poorly managed, they can be weaponized for outages and to provide anonymity for cybercriminals. Prompt and thorough remediation efforts are crucial, not only to protect individual device owners but also to safeguard the integrity of the broader internet from this widespread threat.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.