Dysphoria IoT Botnet Evolves with Blockchain C2 and Victim Relays Post-JackSkid Takedown
The Dysphoria IoT botnet has adopted blockchain-based name services for its command and control (C2) infrastructure and is using infected devices as relays, making it more resilient to takedowns following the disruption of the JackSkid botnet.
The Dysphoria Internet of Things (IoT) botnet has undergone a significant evolution, incorporating blockchain-based name services for its command and control (C2) infrastructure and leveraging infected devices as traffic relays. This strategic shift, observed after a coordinated law-enforcement operation in March disrupted the JackSkid botnet infrastructure, aims to enhance the botnet's resilience against takedown efforts.
Researchers from China's national computer emergency response team, CNCERT, and XLab, the threat-intelligence lab of Qi'anxin, estimate Dysphoria's population to be over 200,000 bots. Their telemetry indicated a substantial number of active devices, with a peak of nearly 240,000 bots observed abroad in a single day between July 14 and 20, though these figures have not been independently verified.
The lineage of Dysphoria is closely tied to JackSkid, one of four IoT botnets targeted in a joint operation by U.S., German, and Canadian law enforcement agencies. Court documents revealed that JackSkid alone was responsible for over 90,000 distributed denial-of-service (DDoS) commands. Following this disruption, operators quickly pivoted to using an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for C2 communications.
XLab's analysis shows that a JackSkid sample captured shortly after the takedown already utilized this ENS domain. Further investigation revealed that different blockchain records, specifically burrberry[.]eth and 24carnforth2merseyside[.]sol, encode critical infrastructure details, including distribution-node IP addresses and other C2 endpoints. These distribution nodes then provide bots with lists of current servers, which are themselves compromised devices acting as relays.
This architecture effectively places the ultimate controllers one step removed from the botnet's direct communication channels, complicating traditional server seizure tactics. The botnet's development has been rapid, with custom RC4 string encryption and ENS resolution appearing in late April, followed by a switch to Solana Name Service (SNS) resolution in early May. A relay-only variant emerged in late June, further enhanced with UPnP-based port mapping to bypass NAT gateways.
The relay-only build specifically drops DDoS modules and instead uses UPnP to map ports on local gateways, coupled with Linux epoll, to shuttle traffic between external connections and remote C2 services. This sophisticated relay mesh, built from the botnet's own victims, presents a significant challenge for defenders attempting to disrupt its operations. The Kimwolf botnet, also documented by XLab, was previously observed using ENS-based C2.
While the shift to blockchain C2 and victim relays complicates conventional takedowns, the botnet still relies on accessible blockchain records, compromised distribution nodes, and the infected relays themselves. Independent analysis by Japan's NICT corroborated the JackSkid-to-ENS/SNS shift and noted code overlaps with other botnet families, suggesting shared tooling rather than a single operator.
Dysphoria primarily spreads through brute-force attacks against Telnet and SSH weak credentials, as well as exploiting known remote code execution vulnerabilities in IoT devices like routers, gateways, and cameras. One identified vulnerability is CVE-2025-9528, a command-injection flaw in a Linksys E1700 router, though its specific role in the botnet's propagation chain remains unclear. Despite claims of large-scale attacks, no independent measurements of attack peaks or confirmed device counts have been published.