The Dysphoria botnet now controls about 200,000 devices worldwide, using blockchain domains for its command-and-control (C2) infrastructure. That’s a massive jump from the early variants spotted in March.
Key Takeaways
- ~200k infected devices, up from initial discovery in March 2024.
- Uses Ethereum ENS and Solana SNS domains to hide C2 addresses.
- Variants split between DDoS attacks (up to 4 Tbps) and pure proxy functions.
- Spreads via weak Telnet/SSH credentials and recent IoT CVEs.
- Peak traffic observed: 740,000 daily pings, 239,000 overseas connections.
Dysphoria botnet: scale and new blockchain C2
QiAnXin XLab researchers first logged Dysphoria on March 25, 2026, and they’ve been tracking it ever since. “Since the first quarter of 2026, XLAB has continuously tracked an emerging botnet family named Dysphoria, whose bot count exceeds 200,000,” reads XLab’s report. The team says the botnet has shown “extremely strong resilience” with frequent variant updates.
What makes this family stand out is its use of blockchain name services—Ethereum ENS and Solana SNS—to resolve C2 endpoints. By embedding address data in domain records, the operators make takedown attempts far more complicated. That’s the catch: traditional sinkholing methods struggle when the resolver lives on a public blockchain.
Evolution from jackskid and fbot
Dysphoria didn’t appear out of thin air. It evolved from earlier malware families known as ‘jackskid’ and ‘fbot’. Those predecessors already abused UPnP for port forwarding, but Dysphoria adds a covert byte‑transformation algorithm that hides C2 info inside fake IPv6 strings. The algorithm scrambles the address, then the infected client runs a custom routine to recover it.
The researchers observed multiple iterations. Early versions simply relayed traffic and launched DDoS attacks. Later variants introduced a multi‑chain resolution system and separated the relaying and DDoS capabilities into distinct binaries.
Technical tricks: ENS, SNS and IPv6 obfuscation
Ethereum ENS and Solana SNS are public naming services that map human‑readable names to blockchain addresses. Dysphoria queries these services to pull the latest C2 host info. Because the domain records live on immutable ledgers, defenders can’t easily alter or delete them.
Once the client receives the ENS/SNS record, it decodes a fake IPv6 string. The string looks like a normal IPv6 address, but embedded within are bytes that, after transformation, reveal the true C2 IP and port. This clever obfuscation lets the botnet stay under the radar.
Payload structure
Infected hosts send a fixed 78‑byte login and heartbeat packet to the C2. The server replies with a command block that includes attack duration, type, target list, and configurable flags. The payload is compact, reducing bandwidth and making detection harder.
Payloads: DDoS vs proxy variants
Two major functional strands have emerged. The classic DDoS variant can generate up to 4 Tbps of traffic, according to the operators’ own clearnet site that markets it as a stress‑testing service. While that’s lower than the record 31.4 Tbps set by the Aisuru/Kimwolf botnet in December 2025, it’s still enough to cripple mid‑size services.
In late June, XLab saw a new branch that discarded the DDoS code entirely. Instead, it turned infected devices into network proxies, exposing internal services via 155 UPnP port‑forwarding rules. This shift suggests the operators are diversifying revenue streams—perhaps selling proxy bandwidth to shady actors.
Both variants share the same core infection mechanism, but their impact differs. DDoS bots flood targets, while proxy bots route traffic, potentially aiding credential‑stealing or data‑exfiltration campaigns.
Spread vectors: Telnet, SSH and IoT flaws
The botnet spreads primarily through weak Telnet and SSH credentials. It also exploits several recent IoT vulnerabilities: CVE‑2025‑55182 (React2Shell), CVE‑2025‑34152, CVE‑2025‑28137 (Totolink), and CVE‑2025‑9528 (Linksys). Older bugs like CVE‑2017‑17215 (Huawei) and CVE‑2020‑8515 (DrayTek) remain viable, showing how legacy devices keep feeding the botnet.
Once a device is compromised, the malware uses UPnP to create the massive port‑forwarding rule set. That gives attackers inbound access from the internet, turning home routers or cameras into unwitting relays.
Geographic distribution
XLab monitored traffic between July 14 and July 20. The botnet generated a peak of 740,000 daily pings from infected hosts, with 239,000 connections originating from overseas clients and 1,800 from China. Those numbers illustrate the global reach and the concentration of traffic in certain regions.
Impact and the numbers behind the traffic
Even if the reported 4 Tbps maximum is an optimistic claim, the botnet can still cause notable disruptions. A single DDoS campaign at that scale could overwhelm regional CDNs, knock out smaller SaaS platforms, or force ISPs to throttle traffic.
Beyond DDoS, the proxy variant can be a conduit for credential harvesting, ransomware distribution, or even crypto‑mining traffic. The dual‑nature design makes Dysphoria a flexible tool for cyber‑criminals.
- ~200,000 infected devices (researchers’ estimate).
- Peak of 740,000 daily pings observed.
- 4 Tbps claimed DDoS capacity.
- 155 UPnP port‑forwarding rules per infected host.
- Exploits: CVE‑2025‑55182, CVE‑2025‑34152, CVE‑2025‑28137, CVE‑2025‑9528, CVE‑2017‑17215, CVE‑2020‑8515.
Defenders can’t rely on traditional blacklisting alone. Because the C2 resolves via blockchain, sinkholing domains won’t cut the communication path. Instead, security teams need to focus on hardening the vulnerable entry points.
What This Means For You
If you manage IoT fleets, you’ve got to audit firmware versions and patch any known CVEs immediately. Change default admin passwords, disable remote access when you don’t need it, and lock down UPnP unless it’s essential for your use case.
Developers building services that might be targeted should consider rate‑limiting inbound traffic and deploying strong DDoS mitigation services. Monitoring for unusual inbound connections—especially a surge of short‑lived pings—can give early warning of a proxy‑mode infection.
Network teams should also watch for traffic patterns that match the 78‑byte heartbeat signature described by XLab. Adding a simple signature rule to IDS/IPS can flag infected hosts before they’re used in a large‑scale attack.
Ultimately, the Dysphoria botnet underscores how attackers are marrying traditional malware tactics with decentralized infrastructure. As long as blockchain name services stay open, they’ll remain a convenient hiding spot for malicious actors.
Will future botnets keep moving to decentralized C2, or will defenders develop new ways to intercept blockchain‑based traffic? That’s the question we’ll be watching closely.
Historical Context and Precedents
The concept of using decentralized identifiers for malicious C2 isn’t brand new. Earlier botnets experimented with DNS tunneling, using fast‑changing domain names to evade detection. Those campaigns taught researchers that any mutable naming layer can become a conduit for stealthy communications.
Dysphoria builds on that playbook, swapping mutable DNS for immutable blockchain records. The shift is subtle but powerful: once a name is minted on a public ledger, it can be updated without any central authority. That quality mirrors the resilience seen in peer‑to‑peer botnet designs from the early 2010s, where nodes could rejoin the network after a takedown.
When the QiAnXin XLab team first reported Dysphoria in March, the security community noted the similarity to prior “cryptojacking” campaigns that used ENS for profit‑driven mining. The new botnet, however, repurposes the same infrastructure for command distribution rather than resource harvesting.
Understanding this lineage helps explain why the botnet’s operators chose ENS and SNS. They needed a naming service that could survive aggressive takedown attempts, and the blockchain’s consensus mechanisms provide exactly that durability.
Technical Architecture Deep Dive
At a high level, each infected device runs a lightweight daemon that performs three core functions: credential brute‑forcing, C2 resolution, and payload execution. The daemon begins by scanning the local network for open Telnet or SSH ports, then attempts a dictionary of common credentials. Successful logins trigger the download of the main binary via a hard‑coded URL.
Once the binary is resident, it contacts the blockchain name service. The query is a simple HTTP request to an ENS or SNS resolver endpoint, which returns a text record containing the fake IPv6 string. The daemon parses the string, isolates the embedded byte sequence, and runs a reversible transformation – essentially a XOR‑based shuffle – to reveal the true IP address and port.
After deobfuscation, the client opens a TCP connection to the C2 server and sends the fixed 78‑byte login packet. The server responds with a command block that can instruct the client to start a flood, open a proxy tunnel, or simply maintain the heartbeat. All commands are encoded in a compact binary format to keep the traffic profile low.
The proxy variant extends the daemon’s responsibilities. It configures 155 UPnP port‑forwarding entries, each mapping an external port to an internal service. The C2 then uses those ports to route inbound traffic through the compromised device, effectively turning it into a relay for any downstream malicious operation.
This modular design means the same infection vector can spawn either a high‑volume attacker or a low‑profile proxy, depending on the operator’s immediate revenue goals. The codebase is deliberately split into two binaries, allowing the botnet maintainer to push updates to one strand without affecting the other.
Key Questions Remaining
- Will blockchain‑based C2 become the default for next‑generation botnets, or will new counter‑measures render it impractical?
- How will ISPs respond to the surge of short‑lived pings that signal proxy‑mode infections?
- Can manufacturers embed firmware checks that automatically disable UPnP after a security breach, and will that be enough to stem the tide?
- What legal frameworks are needed to address the use of public blockchain records for illicit purposes?
Answers will shape the defensive playbook for years to come. Researchers must keep tracking variant evolution, while operators should prioritize remediation of the exposed entry points.
Sources: BleepingComputer, original report
