**IoT Botnet Dysphoria: A New Era of Blockchain-Based Attacks**
The landscape of IoT botnets has taken a concerning turn with the emergence of Dysphoria, a sophisticated malware family that leverages blockchain technology to hide its command and control (C2) infrastructure. According to a recent report jointly published by X Lab (the research arm of QAX) and the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT), this botnet has infected over 200,000 devices since its first appearance in March 2026. Unlike traditional botnets, Dysphoria utilizes Ethereum and Solana blockchain domains to dynamically retrieve C2 server addresses, effectively bypassing conventional takedown methods and presenting a significant challenge for cybersecurity professionals.
### How Blockchain Domains Replace Command Servers
Most conventional botnets rely on hardcoded IP addresses or centrally managed domain names to communicate with their command servers. This architecture provides defenders with a fixed target that can be seized or sinkholed by authorities. Dysphoria, however, employs a more resilient strategy by querying the Ethereum Name Service (ENS) and Solana Name Service (SNS).
Instead of resolving a standard domain to an IP address, Dysphoria retrieves C2 infrastructure details from TXT records associated with blockchain domains. For example, the ENS domain *burrberry.eth* contains a “node” record that points to relay distribution addresses. Another domain, *ukranianhorseriding.eth*, provides base network infrastructure via a “network” key. A Solana domain, *24carnforth2merseyside.sol*, introduced in May, operates similarly through a “deserialised” record.
Because blockchain name registrums exist outside the traditional domain registration ecosystem, they are not subject to conventional takedown processes. There is no registrar or hosting provider to issue a notice or seize the domain, making disruption extremely difficult for defenders.
Furthermore, the TXT data itself does not contain plain-text IP addresses. X Lab’s analysis revealed the data is formatted to resemble IPv6 addresses, with the actual IPv4 C2 target hidden within specific byte segments. The real address is decoded using a permutation function involving bit rotation and XOR operations against a fixed key. For instance, a string like `12e7:13d7` appears as a dead IPv6 entry but decodes to the active IPv4 address `144.31.38.215` once processed.
### From Single Malware Family to a Relay Network
The evolution of Dysphoria has been rapid and methodical. A sample captured on March 25 was based on the *jackskid* lineage and connected to a Telegram channel via an ENS domain. By April 1, the variant had shifted to the *fbot* framework. In late April, the malware incorporated a new RC4-based string encryption scheme and the blockchain C2 lookup mechanism. By early May, the Solana domain was integrated, expanding the botnet’s decentralized infrastructure.
The family split functionally in June. On June 25, researchers captured a sample that had been stripped of DDoS attack code, serving purely as a relay and proxy node. Just two days later, UPnP-based automated port mapping was added, allowing the bot to open ports on routers automatically. This enabled the creation of a hybrid C2 structure that combined DDoS-capable attack tools with compromised devices repurposed as relay points.
The DDoS-capable variant utilizes a custom RC4 decryption routine to protect embedded strings. This scheme layers a Linear Congruent Generator into the key-scheduling phase and a Linear Feedback Shift Register into stream generation. Attack commands follow a nested structure, specifying duration, attack type, target IP ranges with netmasks, and various flags for parameter control. Login and heartbeat packets are both fixed at 78 bytes, distinguished by separate 12-byte magic values.
### Turning Infected IoT Devices into Proxy Infrastructure
One of the most concerning aspects of Dysphoria is its ability to turn infected IoT devices into proxy infrastructure for other malicious actors. The relay-only variant, which emerged in late June, is designed to convert an infected device behind a NAT router into a usable proxy point.
Since most IoT devices cannot accept inbound connections directly, the malware scans the local network for gateways supporting UPnP and then calls the WAN connection service to open a port—specifically port 155—on the router. Once the port is open, the compromised device uses Linux’s epoll asynchronous I/O to bind an inbound connection from an attacker or DDoS client to an outbound connection toward the real target, forwarding traffic in both directions without buffering the full stream.
The device then sends a heartbeat report every four seconds to a collection domain (login.trees4sale.net) in JSON format, detailing active connection count and bandwidth usage. For the device owner, the only noticeable symptom is unexplained bandwidth consumption.
Propagation occurs mainly through Telnet and SSH weak-password brute-forcing, combined with known remote code execution vulnerabilities in routers, gateways, and cameras. The vulnerability list includes older flaws like CVE-2017-17215 and CVE-2020-8515, as well as more recent disclosures such as CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, and CVE-2025-55182. This mix indicates active maintenance of the propagation code, with weak credential brute-forcing remaining the most consistent entry point.
### Scale and Commercial IoT Botnet Rental Model
Monitoring by X Lab revealed 4,401 confirmed active bots within China between July 14–20, 2026, with a daily peak of 1,801 online and 740,000 C2 sessions on the busiest day. Overseas infections were even larger, peaking at 239,000 bots in a single day. The report notes that the relay conversion mechanism inflates the apparent footprint of controlled infrastructure.
Leaked screenshots of the Dysphoria control panel, circulating on social media, show a consistent bot count near 200,000, aligning with the lab’s monitoring figures. The operators further monetize the botnet by advertising DDoS packages on a public page, offering up to 4 Tbps of attack capacity. Prices range from tens to hundreds of dollars depending on duration and bandwidth tier. Targets include internet services and gaming companies across multiple countries, with attack activity logged on a near-daily basis.
### FAQ
**Q: What is IoT botnet Dysphoria?**
A: Dysphoria is an IoT botnet that has infected over 200,000 devices. First appearing in March 2026, it is notable for using Ethereum and Solana blockchain domains for command and control (C2) instead of traditional IP addresses or domain names.
**Q: How does Dysphoria use blockchain domains?**
A: Dysphoria queries the Ethereum Name Service (ENS) and Solana Name Service (SNS) to retrieve C2 server addresses from TXT records. These records do not contain plain IP addresses; instead, they hold data that must be decoded using a bit rotation and XOR function, making casual detection difficult.
**Q: Why is using blockchain domains more effective for botnets?**
A: Blockchain name registries operate outside conventional takedown processes. There is no registrar or hosting provider to serve notice on, making the infrastructure significantly harder to disrupt than standard domain-based C2 servers.
**Q: How has the malware evolved since its discovery?**
A: The malware has evolved from a jackskid-based family in March to variants using fbot frameworks, RC4 encryption, and eventually integrating Solana domains by May. In June, the family split into distinct roles, with some devices acting as proxies and others capable of DDoS attacks.
**Q: How does the botnet spread?**
A: Dysphoria primarily spreads through Telnet and SSH weak-password brute-forcing, exploiting known vulnerabilities in IoT devices. This includes both older vulnerabilities and more recent CVEs, indicating ongoing active maintenance.
**Q: What can security teams do to defend against Dysphoria?**
A: Recommended actions include disabling Telnet when unnecessary, rotating default SSH credentials, and patching known vulnerabilities. Monitoring for UPnP port-mapping requests and unexpected connections to port 9000 can also help detect relay behavior.
### Conclusion
IoT botnet Dysphoria represents a significant evolution in the threat landscape, demonstrating how blockchain technology can be co-opted to create resilient, censorship-resistant command and control infrastructures. By moving beyond traditional domain registration and encrypting C2 communications, the botnet operators have successfully evaded conventional defensive measures. With its ability to monetize through DDoS-for-hire services and its proven capacity to infect hundreds of thousands of devices, Dysphoria serves as a stark reminder that IoT botnet defense must continue to evolve. Security teams must prioritize foundational hygiene—strong credentials, patch management, and network monitoring—to mitigate the risks posed by these increasingly sophisticated threats.
