Dysphoria Botnet Compromises 200,000 Devices for DDoS and Traffic Relay Operations

According to BleepingComputer, a newly identified botnet dubbed Dysphoria has compromised approximately 200,000 devices worldwide. The operators are reportedly using the infected fleet for two purposes: launching distributed denial-of-service (DDoS) attacks and running traffic relay/proxy operations. Details on the specific infection vector, targeted device types, and command-and-control infrastructure were not fully specified in the initial reporting.

Why It Matters

A botnet of this scale represents significant potential DDoS capacity that could be directed at any target the operators (or their customers, if this is a DDoS-for-hire or proxy-for-rent operation) choose. The dual-use nature — DDoS plus traffic relaying — suggests the infrastructure may also be monetized as a residential/IoT proxy network, which complicates attribution of malicious traffic back to its true source. Organizations of any size could be affected either as victims of DDoS traffic originating from Dysphoria nodes, or unknowingly as hosts if their own devices are compromised and absorbed into the botnet.

What Defenders Should Watch For

• Unexplained outbound connections from internal or edge devices (routers, IoT, servers) to unfamiliar external IPs, particularly sustained or periodic beaconing patterns consistent with C2 check-ins.
• Devices exhibiting unusual outbound traffic volume or protocol usage inconsistent with their normal function, which may indicate use as a relay/proxy node.
• Spikes in inbound traffic consistent with DDoS activity (SYN floods, UDP floods, or application-layer request floods) against internet-facing services.
• Review of internet-exposed and IoT/embedded devices for unpatched firmware, default credentials, or known exploited vulnerabilities, as these are common entry points for botnet recruitment.
• Where available, cross-reference outbound connection destinations against emerging threat intelligence feeds as more indicators of compromise for Dysphoria are published.

This is a developing story and public technical detail on Dysphoria's infection chain and infrastructure remains limited at this time. Defenders should treat the figures above as preliminary and monitor for follow-up reporting and IOCs. Read the original coverage at BleepingComputer.