Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays
Do Son 
At a glance
| Malware family | Dysphoria (jackskid/fbot-derived IoT botnet) |
| Threat actor | Unattributed; run as a commercial DDoS-for-hire service |
| Target | About 200,000 IoT and embedded Linux devices worldwide, mostly routers, gateways, and IP cameras |
| Delivery vector | Telnet/SSH weak-credential brute force plus known IoT RCE exploits |
| Key capabilities | Multi-vector DDoS, blockchain ENS/SNS C2, victim-to-relay conversion, UPnP NAT traversal |
| Source | QiAnXin XLab and CNCERT |
TL;DR
The Dysphoria botnet has grown past 200,000 compromised devices since early 2026. It hides its command servers behind blockchain domain records and turns victims into relay nodes. XLab and CNCERT say this design makes the botnet much harder to take down.
Delivery
Dysphoria spreads like most IoT botnets. It brute-forces weak Telnet and SSH logins on exposed devices. It also exploits known remote code execution flaws in routers, gateways, and cameras. The mix ranges from old favorites, such as CVE-2017-17215, to recently disclosed bugs.
Infection chain
The family runs in two forms. One is a DDoS attack bot. The other is a pure relay node with no attack code. Both rename their process to pose as a legitimate Android system library.
XLab traced fast iteration since March. A jackskid sample appeared first, an fbot variant followed in April, and Solana support arrived in May. Newer builds added a custom RC4 string scheme to slow analysis. The Dysphoria botnet then moved its C2 lookup onto blockchain name services.
Command-and-control and exfiltration
Here is the clever part. Instead of a fixed server, the bot queries Ethereum ENS and Solana SNS records. Those records hold fake IPv6 strings that hide a real IPv4 address. The bot decodes it with a custom byte transform.
The decoded address points to a distribution node. That node returns a live list of C2 addresses over HTTP. But XLab found that “all returned C2 addresses are in fact relay nodes converted from other compromised hosts.” So the true controllers never appear in bot traffic.
The relay build extends this trick. It uses UPnP to open up to 155 ports on the local router. It then binds inbound and outbound connections with Linux epoll for fast, transparent relaying. Each relay reports its health to a collection server every few seconds.
Scale and business model
The numbers are large. Between July 14 and 20, XLab logged a daily peak of 740,000 C2 requests. Domestic active bots in China reached 4,401, while overseas online bots peaked near 239,000. The operators sell tiered DDoS plans and claim up to 4 Tbps of firepower. XLab calls this “a sign of a fairly mature commercial operation.” Researchers have not named an operator, and shared code across families points to common tooling rather than one actor.
Defense and detection
Blocking one IP or domain does little here. The Dysphoria botnet rotates infrastructure through blockchain records and victim relays. Defenders should focus on the devices themselves.
What to check
- Replace default Telnet and SSH credentials, and disable unused remote access.
- Patch router, gateway, and camera firmware against known RCE flaws.
- Inspect routers for unexpected UPnP port mappings.
- Watch for outbound traffic to blockchain name services from embedded devices.
- Segment IoT devices away from critical systems.
Read the full technical breakdown in XLab’s analysis.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
