Most botnet stories end with the same advice: change the default password, install the firmware update. Useful, true, and by now a little worn.

Dysphoria is worth your attention because of a detail that breaks the pattern. In June 2026, one of its variants stopped trying to hide from your router and started using it — instructing the compromised device, via UPnP, to open 155 port-forwarding rules in its own firewall. The malware asked the router to expose the network, and the router, doing exactly what it was designed to do, said yes.

What Dysphoria Is

Researchers at QiAnXin XLab began tracking Dysphoria on March 25, 2026. It descends from the jackskid and fbot families — part of the same lineage that produced the record-setting Aisuru botnet — and it targets the usual population: internet-exposed routers, gateways, repeaters, IP cameras, and other embedded Linux devices.

The scale reporting has moved as the campaign has grown. XLab’s July analysis put it at roughly 200,000 compromised devices, with monitoring between July 14 and 20, 2026 recording a peak of 740,000 daily pings from infected hosts. Subsequent reporting tracked the footprint to approximately 296,000 devices as the operation expanded through UPnP-assisted proxy mapping. Its operators advertise a maximum DDoS capacity of 4 Tbps — modest next to Aisuru’s 29.7 Tbps record, but more than sufficient to remove most targets from the internet.

How It Gets In

Two routes, both entirely ordinary:

Weak Telnet and SSH credentials. Still the front door. Still working.

A grab-bag of known CVEs, none of them new:

CVEAffectedNote
CVE-2025-55182React2Shell (Next.js / React Server Components)CVSS 10.0, unauthenticated RCE via a single HTTP request
CVE-2025-34152TOTOLINK
CVE-2025-28137TOTOLINK
CVE-2025-9528Linksys
CVE-2017-17215HuaweiNine years old
CVE-2020-8515DrayTekSix years old

The two at the bottom are the story. A botnet assembled in 2026 is still profitably exploiting a Huawei flaw disclosed in 2017, because a meaningful number of the routers deployed in 2017 are still plugged in, still online, and no longer receiving updates from anyone. Every botnet builder knows this. It is why end-of-life hardware is not a warning, it’s a decision — one you make by not replacing the box.

The React2Shell inclusion is the modern half. That CVSS 10.0 flaw has been mass-exploited by the RondoDox botnet since December 2025, and it now feeds Dysphoria too — RondoDox is the same crew we covered reviving an eight-year-old ASUS flaw. Once an exploit is commoditized, every operator picks it up.

The UPnP Move

Here is the part worth understanding properly.

UPnP — Universal Plug and Play — exists so that a game console or video-call app can ask your router to open an inbound port automatically, without you learning what a port is. The router grants these requests from any device on the local network, with no authentication whatsoever. That is not a bug in UPnP. That is UPnP.

Which means the moment malware lands on any device behind your router, it inherits the ability to reconfigure your firewall. Dysphoria’s June variant did precisely that, creating 155 port-forwarding rules to expose services and establish reachable relay infrastructure inside the victim’s network.

The result is a persistent hole that survives what most people would consider cleanup. Factory-reset the infected camera and the mappings can remain on the router. Scan the network from inside and everything looks normal — the rules are supposed to be there, as far as the router is concerned. Meanwhile, from the internet, doors are open into your home network that you never opened and cannot see without going looking.

Command and Control You Cannot Seize

Dysphoria resolves its command-and-control infrastructure through Ethereum Name Service (ENS) and Solana Name Service (SNS) domains, concealing the resolved addresses inside strings formatted to look like IPv6 addresses.

Traditional takedowns work by pressure on a chokepoint: a registrar suspends a domain, a hosting provider pulls a server, a court order seizes infrastructure. That’s the mechanism behind the coordinated actions that disrupted Aisuru, KimWolf, and JackSkid earlier in 2026. A blockchain name record has no registrar to serve, no provider to pressure, and no administrative party who can comply. The operator updates the record; the bots follow.

There is a direct consequence for you. Assume nobody is going to rescue your device. The takedown that cleans up a botnet from the top is materially less likely here, which shifts more of the defensive weight onto the only party who can reliably act — the person who owns the hardware.

Two Botnets in One

Dysphoria runs in two modes, and the second is arguably worse for a home user.

The DDoS variant does what botnets have always done: your bandwidth joins a flood aimed at someone else. Annoying, mostly invisible, occasionally noticed as slow internet.

The proxy/relay variant — including a relay-only build that strips out DDoS functionality entirely — turns your connection into residential proxy infrastructure. Attacker traffic exits the internet wearing your IP address and your ISP’s reputation. Fraud, credential stuffing, and intrusion attempts get attributed to your household.

That second mode is where botnets have been heading all year, because clean residential IPs are worth more per hour than raw attack bandwidth. It’s the same economics behind the KadNap botnet renting out ASUS routers and the twenty-year, $46 million proxy empire the FBI dismantled. Your router is not being stolen for its power. It is being rented for its respectability.

Check Your Own Router Tonight

This takes about ten minutes and is genuinely worth doing regardless of Dysphoria.

1. Open your router admin page and find the port forwarding / virtual server table. Read every rule. You should recognize every single one, and for most households the correct number of rules is zero. Anything you did not create — delete it.

2. Find the UPnP settings and look at the active mappings list, if your router exposes one. Dozens of rules you cannot account for is the signature described in this campaign.

3. Turn UPnP off. This is the single highest-value change in this article. Something may break — a game console, a video-call app — and if so, add one manual port-forward rule for it deliberately. That is a small, one-time inconvenience in exchange for removing an unauthenticated firewall-configuration API from your network.

4. Disable remote administration and any WAN-side management interface. If you can reach your router’s login page from outside your house, so can everyone else.

5. Turn off Telnet and SSH on every device that offers them and doesn’t need them — and change credentials on the ones that do. Weak Telnet and SSH remain Dysphoria’s primary path in.

6. Update firmware everywhere, and check the CVE list above against what you own. TOTOLINK, Linksys, DrayTek, and Huawei devices are named targets in this campaign.

7. Replace anything past end-of-life. A 2017 CVE is still earning money for botnet operators in 2026 for exactly one reason.

8. Segment your IoT devices. Cameras and DVRs on their own VLAN cannot reach your laptops, and — importantly here — a compromised camera on a segment where UPnP is disabled cannot rewrite your main firewall.

Bottom Line

Dysphoria is not the biggest botnet of 2026, and its 4 Tbps is not the scariest number you’ll read this year. What makes it instructive is the combination: command infrastructure that cannot be seized, spreading through vulnerabilities up to nine years old, and using a protocol your router enables by default to open its own front door.

None of those three things will be fixed by anyone above you. Go turn off UPnP.

Sources