Dysphoria Botnet Compromises Nearly 300,000 Devices for DDoS Attacks and Residential Proxy Services
The Dysphoria botnet has already compromised nearly 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. The infrastructure is used primarily for DDoS attacks and has recently added residential proxy functionality.
Researchers began tracking the threat in the first quarter of 2026. It evolved rapidly from the jackskid and fbot malware families. On peak days, up to 239,000 infected devices were observed active outside China.
Propagation relies mainly on brute-force attacks against Telnet and SSH services protected by weak passwords. The botnet also exploits known remote code execution vulnerabilities in IoT devices.
One of the most notable developments is the use of domains based on the Ethereum and Solana networks to locate command-and-control servers. This approach complicates infrastructure takedowns and allows operators to rotate addresses quickly.
Compromised devices can act as intermediate nodes. The malware uses UPnP to open ports on home routers, turning residential connections into relays that conceal the origin of malicious traffic.
Operators publicly advertise attack capacity of up to 4 Tbps and offer multiple DDoS service packages, indicating a structured commercial operation. Observed targets include internet service providers and gaming platforms across various countries.
Related articles
TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign
Researchers at Checkmarx examined the ChainVeil campaign that used npm packages to distribute multi-stage JavaScript loaders. A newly discovered sample appeared in a GitHub repository recommended by an AI agent, where the file navigation.js contained an obfuscated loader that matched the campaign's techniques. The loader retrieves encrypted payloads from TRON, falls back to Aptos, and then uses the extracted data as a BSC transaction identifier to fetch the next stage. C2 infrastructure and final RAT functionality aligned exactly with previously published indicators, except for the campaign identifier A9-0554-3 instead of the A6-* markers seen in npm samples. Git history showed the malicious code was inserted via a merge commit on 29 March 2026, months before the first known npm packages appeared in May. The findings indicate that npm was never the only distribution channel for ChainVeil and that the campaign's blockchain-based delivery mechanism has been active since at least early 2025.
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.
Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.