Dysphoria Botnet Infects 200,000 Devices Using Blockchain DNS and IoT Exploits

·1 views

A newly identified DDoS botnet called Dysphoria compromised approximately 200,000 Linux-based IoT devices globally, with daily infections peaking at 239,000 between July 14 and 20, 2026. The malware spreads by exploiting weak Telnet and SSH credentials alongside multiple known remote code execution vulnerabilities targeting routers, gateways, and cameras. Dysphoria uses blockchain-based name resolution systems — Ethereum Name Service and Solana Name Service — to retrieve multi-stage command-and-control server addresses, making infrastructure takedowns harder. Infected devices are repurposed either as DDoS bots or as relay nodes that open up to 155 forwarded ports via UPnP, effectively masking the real C2 server behind victim devices. Operators reportedly advertised up to 4 Tbps of attack capacity, and defenders are advised to disable Telnet, apply patches, block port 9000 traffic, and disable UPnP to mitigate exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Understanding Lifetime Variance in Rust: Covariance, Invariance, and Contravariance

Rust's type system uses variance to describe how generic and lifetime parameters relate to each other in a type hierarchy, determining when one type can substitute for another. Covariance allows a type to be replaced by a subtype, such as a longer-lived 'static reference standing in for a shorter-lived 'a reference. Invariance requires an exact type match, as seen with mutable references, where no substitution in either direction is permitted. Contravariance works in the opposite direction, meaning a function accepting a broader lifetime parameter is considered more useful than one with stricter requirements. These three variance rules govern safe substitution throughout Rust programs, and understanding them is essential for writing correct code involving complex lifetime annotations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust Lifetimes Explained: How the Borrow Checker Validates Reference Safety

In Rust, every reference carries a lifetime — the code region during which it must remain valid — and the compiler's borrow checker traces each reference back to its origin to detect conflicts. Lifetimes do not always align perfectly with lexical scopes; for example, a reference used only in one branch of an if-else does not extend into the other branch. When a reference is reassigned inside a loop, Rust treats the new assignment as a fresh lifetime, allowing the old one to safely end. Developers sometimes need to annotate lifetimes explicitly, particularly when storing references inside custom types or returning references that outlive the containing object. When the borrow checker cannot confidently verify a borrow's validity, it rejects the code, which is one reason Unsafe Rust exists as an escape hatch.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DNS Poisoning on Hotel Wi-Fi Used to Steal Microsoft 365 Corporate Credentials

Cybersecurity researchers have identified a high-severity attack campaign in which threat actors compromise Wi-Fi gateway management interfaces at hotels and conference centers to manipulate DNS responses. Victims connecting to these networks are silently redirected to convincing fake Microsoft 365 sign-in pages without any phishing email or malicious link involved. The attackers also exploit the WPAD protocol to route device traffic through a malicious proxy, enabling them to harvest OAuth tokens via Microsoft Entra ID's device-code authentication flow. Because no malware is planted on the victim's device and the fake pages closely mimic legitimate Microsoft interfaces, users are unlikely to detect the compromise. Mitigations include enforcing always-on VPNs, disabling WPAD, blocking device-code flows in Conditional Access policies, and requiring phishing-resistant MFA with device compliance checks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CISA Flags Actively Exploited FortiOS Flaw That Bypasses Patch Mitigations

CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog on July 27, 2026, flagging it as a critical actively exploited flaw in Fortinet's FortiOS. The vulnerability allows attackers who have already gained file-system-level access to a FortiOS device to plant malicious symlinks that persist even after firmware updates or patches are applied. By sending crafted HTTP requests to the SSL-VPN web interface, an attacker can read sensitive files such as credentials, configurations, and encryption keys. Affected versions span FortiOS 6.4 through 7.6.1, with Fortinet recommending upgrades to versions 7.4.7, 7.6.2, or later alongside full device rebuilds and credential rotation. Security teams are advised to restrict or disable SSL-VPN interface exposure and audit devices for symlink artifacts, as standard patching alone does not eliminate existing compromises.

0 comments Read more at DEV Community