Dysphoria has turned a large number of everyday internet-connected devices into a potential attack network.
The botnet is linked to roughly 296,000 compromised devices, placing routers, cameras, gateways, and other connected equipment at risk of being used against targets chosen by its operators. The scale matters because these devices often sit quietly at homes and small businesses, unseen and unmanaged.
Once controlled, the devices can generate traffic in a coordinated distributed denial-of-service, or DDoS, attack, making a website or online service difficult to reach. The same access can also give criminals a way to route their own traffic through an unsuspecting victim's connection. Analysts at Shadowserver noted the activity in a critical special report that records the compromised-device dataset. Shadowserver said in a report shared with Cyber Security News that Dysphoria's primary apparent role is DDoS activity and that it has recently added residential proxy functionality. The finding shows how an exposed device can create problems beyond its owner's network. A single infected camera may seem minor, but hundreds of thousands of devices responding together can create a substantial pool of traffic, while proxy access can make malicious activity harder to trace to its real source.
Dysphoria targets internet-of-things, or IoT, equipment, a broad category that includes routers, security cameras, gateways, and embedded Linux devices. The result is an attacker-controlled group of machines called a botnet. Each device can wait for instructions, then send a portion of the traffic required for a DDoS attack. The attack traffic comes from many normal-looking residential connections, complicating mitigation.
This model resembles other campaigns that have repurposed consumer equipment, including an AryStinger router proxy network. Dysphoria's reported scale and its proxy capability expand the value of each infected device. Shadowserver classified every event in its special dataset as critical. Its records can include the affected IP address, observed port and protocol, location and network details, device vendor and model where available, and first- and last-seen times. The report does not name a single exploit, password, or malware file responsible for the compromises. Organizations should therefore avoid assuming one remediation step is enough, particularly when they manage mixed fleets of old cameras, routers, and other connected equipment.
Residential proxy functionality changes the risk from simple disruption to potential concealment. Instead of only directing infected devices to flood a victim, operators may pass their own connections through those devices. To an outside service, the activity can appear to originate from ordinary household or small-office internet addresses rather than from the operator's infrastructure. That approach has become a recurring concern in threats involving consumer hardware.
A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised. Administrators should therefore treat externally exposed management services as a priority for review. Owners should install supported firmware updates, replace default and weak administrator passwords, and disable remote administration unless it is necessary. They should also place cameras and similar devices on a separate network where possible, restrict access to management interfaces, and replace equipment that no longer receives security updates. Network operators receiving the special report should investigate listed systems promptly, using the last-seen field to understand how recently activity was observed. They can isolate suspect devices, check account and configuration changes, update or replace the hardware, and monitor for renewed outbound traffic.
The same infrastructure weaknesses that powered Dysphoria also underpin a newer botnet making headlines. Evooo1Bot is a Mirai-based modular Linux botnet malware that has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. Since at least July, Evooo1Bot has been targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across various regions by exploiting known vulnerabilities.
The malware's capabilities extend beyond turning devices into proxy nodes and include credential theft, SSH brute-forcing, and launching distributed denial-of-service (DDoS) attacks. While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. Newer builds include a separate vulnerability-exploitation module targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. However, Fortinet notes that some of the embedded exploits are not correctly implemented, leading to failed exploitation.
When leveraging an exploit successfully, a script downloads one of the 12 available malware builds that match the host's CPU architecture, then clears Bash history to wipe traces of the attack. Evooo1Bot uses encrypted command-and-control (C2) communications over port 443 and performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before it launches on the infected device. Persistence is established through systemd, SysV init, shell profiles, and rc.local, while a cron job attempts to re-download the payload every five minutes.
An interactive shell gives operators direct control over compromised systems, while file-transfer commands support uploads and downloads. The malware also features a credential sniffer module that monitors '/proc/net/tcp' and attempts to capture HTTP Basic Authentication and Cookie headers. The SOCKS5 module supports direct listening and reverse-relay modes, allowing attackers to conceal malicious traffic, circumvent geographic restrictions, or potentially access networks through compromised systems. Fortinet says proxying sessions run independently, and multiple can be opened simultaneously, allowing monetization through residential proxy services if the botnet grows large enough.
The SSH scanner module uses 150 username and password combinations for enterprise-oriented accounts, and performs post-login checks to avoid honeypots. Finally, the DDoS module that was inherited by Mirai supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests.
To defend against botnet malware, keep your IoT devices' firmware updated, replace default admin credentials, turn off remote access panels, and replace devices when the vendor no longer provides support for them. Once attackers have valid credentials, only 37 percent of their actions are blocked. Overall prevention scores can hide what happens after initial access. The Blue Report 2026 measures defenses technique by technique.
A Growing Menace: The Economics of IoT Compromise
The Dysphoria and Evooo1Bot cases highlight a structural problem in the internet-of-things market. Device manufacturers have long prioritized low cost over security, shipping routers and cameras with default administrator passwords that never change, firmware that goes unpatched for years, and management interfaces exposed to the public internet. The result is a globally distributed fleet of compromised machines that can be mobilized for DDoS attacks, residential proxy services, or credential theft operations at scale. Shadowserver's compromised-iot reporting capability tracks these infections in real time, but the volume of new compromises consistently outpaces remediation efforts.
From JackSkid to Dysphoria: The Evolution of IoT Botnets
Dysphoria did not appear in a vacuum. Reporting from CNCERT and QiAnXin/XLab traces its lineage to the JackSkid and fbot ecosystems, which have been circulating IoT malware variants since at least 2023. What distinguishes Dysphoria is its dual-capability design: unlike earlier botnets that focused solely on DDoS, Dysphoria added residential proxy functionality in mid-2026, expanding the criminal business model from disruption alone to traffic concealment. This evolution mirrors broader trends in cybercrime, where modular malware frameworks enable operators to pivot between different abuse types — DDoS, credential harvesting, proxy networks — without rebuilding their infrastructure from scratch.
Evooo1Bot is a Mirai-based modular Linux botnet malware that has been active since at least July 2026. It reuses the DDoS engine from the publicly leaked Mirai source code while extending it with an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. Newer builds include a separate vulnerability-exploitation module targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. However, Fortinet notes that some of the embedded exploits are not correctly implemented, leading to failed exploitation. When leveraging an exploit successfully, a script downloads one of the 12 available malware builds that match the host's CPU architecture, then clears Bash history to wipe traces of the attack.
Why IoT Remains a Soft Target
Internet-facing management services on routers and gates continue to run on devices that are no longer supported by their vendors. Default credentials — admin/admin, root/root, or simply left blank — remain the default state for millions of deployed units. Firmware updates are infrequent, difficult to apply, or entirely unavailable for end-of-life hardware. And segmenting IoT devices from critical networks is uncommon outside of enterprise environments with dedicated security staff.
The consequences extend beyond individual device compromise. When hundreds of thousands of machines respond to coordinated commands, the resulting DDoS traffic can take down e-commerce platforms, disrupt emergency services, or take government websites offline. When the same devices are recruited as residential proxies, investigators tracing malicious activity find themselves following trails that lead back to ordinary households and small businesses, creating attribution nightmares and reputational damage for innocent parties.
Practical Mitigation: What Device Owners Can Do
Device owners should:
-
Patch firmware: Install security updates for routers, cameras, gateways, and other connected devices as soon as they become available. When the vendor no longer provides updates, replace the hardware.
-
Change default credentials: Use unique, strong administrator passwords for every device. Disable unused accounts and avoid predictable usernames such as admin.
-
Disable unnecessary remote access: Turn off internet-facing management services when they are not required. If remote access is essential, use a VPN rather than exposing management interfaces directly to the internet.
-
Segment IoT devices: Place cameras, gateways, and other smart equipment on isolated networks where possible. VLANs on compatible routers, separate SSIDs for IoT devices, and network access control lists can all reduce the blast radius if a single device is compromised.
-
Monitor outbound traffic: Look for unusual connections, unexpected bandwidth use, and repeated communication with unfamiliar destinations. Many home routers now include traffic-monitoring features, and third-party tools can provide deeper visibility.
-
Replace unsupported hardware: Retire devices that no longer receive security updates from the vendor. The small additional cost of new equipment is negligible compared with the potential cost of a botnet compromise.
-
Investigate suspicious behavior: Review logs and network settings when compromise is suspected instead of relying only on a reboot. Check for unknown devices on the network, unfamiliar outbound connections, and changed configuration parameters.
-
Coordinate with providers: Use available threat-intelligence and incident-response channels to investigate suspicious public IP activity. Shadowserver's compromised-iot reporting capability and national CERT advisories provide actionable information for network defenders.
Cyber Security News Dysphoria botnet report
BleepingComputer Evooo1Bot analysis## Looking Ahead: The Persistent IoT Risk
Dysphoria's reportedly 296,000 compromised devices and Evooo1Bot's modular, multi-capability design are not isolated incidents. They are symptomatic of a market segment where security has been an afterthought, and where the volume of new devices far outpaces the rate at which vulnerabilities are remedied. As 5G networks expand and edge computing deployments grow, the total number of internet-connected devices will continue to rise — along with the potential pool of compromised machines available to botnet operators.
Defenders should watch for new Dysphoria variants, changing infrastructure, and additional relay capabilities. Evooo1Bot's combination of DDoS, proxy, credential theft, and SSH brute-forcing in a single framework indicates that the bar for IoT malware is moving upward, and operators who survived earlier botnet waves may face more sophisticated campaigns in the future. The combination of DDoS and residential proxy functionality, in particular, creates a dual-extortion model: attackers can both disrupt targets and conceal their own identity behind victim connections.
The problem is not new. Historical patterns suggest that the situation will not improve without coordinated action. Device manufacturers must ship products with security as a default feature, not an optional add-on. Regulators can mandate minimum-security standards for internet-connected devices, as some jurisdictions have begun to explore. And end users must treat IoT security as a baseline requirement, not an optional convenience.
The Dysphoria and Evooo1Bot cases serve as a reminder that every unsecured router, every unpatched camera, every gateway left exposed to the public internet is a potential entry point for criminal infrastructure. The cost of prevention — a firmware update, a changed password, a segmented network — is measured in minutes. The cost of compromise, for both direct targets and innocent parties whose connections are co-opted, can be measured in hours of downtime, lost revenue, and reputational damage that lasts far longer.
## Conclusion
Two botnets, one shared root cause. Dysphoria and Evooo1Bot demonstrate how the same class of internet-connected devices — routers, cameras, gateways — can be mobilized for distinct but complementary criminal operations. One provides the brute-force power of DDoS attacks; the other adds the covert capability of residential proxy services. Together, they illustrate the breadth of the IoT security challenge and the urgency of closing the gaps that have allowed botnets to flourish for years.
The reporting from Cyber Security News, BleepingComputer, Shadowserver, CNCERT, QiAnXin/XLab, and Fortinet converges on a single point: the problem is widespread, the vectors are well-understood, and the defenses are straightforward. What is lacking is the will to implement them at scale. Device owners who patch, harden, and segment their equipment deny botnet operators the footholds they need. Network operators who monitor for unusual activity and coordinate with threat-intelligence services reduce the time attackers have to operate. And the industry as a whole must move toward shipping internet-connected devices that are secure by design, rather than secure by afterthought.
The router army is real. Its size is measured in the hundreds of thousands. Its capabilities continue to evolve. But so too are the defenses available to those who choose to employ them.