Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Swati KhandelwalJul 27, 2026Botnet / IoT Security

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt.

CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese firm Qi'anxin, put its population above 200,000 bots. Their telemetry logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad.

None of the counts has been independently reproduced. The researchers published no counting or de-duplication methodology, so the numbers should not be read as a precise device census.

Defenders should patch exposed IoT gear, replace devices that can no longer be updated, eliminate default and weak credentials, and disable remote management and UPnP where they are not needed.

The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone.

Within days, Nokia Deepfield and Comcast's threat lab documented the operator falling back to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for command-and-control (C2). XLab's Dysphoria timeline opens with a JackSkid sample captured on March 25, six days after the disruption, that resolves C2 through the same domain.

XLab found that the burrberry[.]eth record encodes distribution-node IPv4 addresses, while 24carnforth2merseyside[.]sol supplies other infrastructure records. The DDoS sample asks a distribution node over HTTP for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers. The design keeps those controllers one step removed from the addresses exposed to bots.

The XLab analysis, published July 25, tracks a fast run of builds: custom RC4 string encryption and ENS resolution at the end of April, followed by Solana Name Service (SNS) resolution in early May. A relay-only variant appeared on June 25, with UPnP-based port mapping added days later to traverse NAT gateways.

The relay-only build drops the DDoS modules and instead uses UPnP to map ports on the local gateway and Linux epoll to shuttle traffic between an outside connection and a remote C2 service. XLab documented the related Kimwolf botnet using ENS-based C2 late last year. Dysphoria couples the same resolution model with a relay mesh built from its own victims.

The shift complicates a conventional server seizure, but it does not remove infrastructure from the chain: the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays.

Japan's NICT independently documented the same JackSkid-to-ENS/SNS shift in May, and, like Nokia and Comcast, found code and strings shared with several other botnet families. That overlap points to shared tooling rather than proof of a single operator, and none of the researchers name one.

XLab and CNCERT say Dysphoria spreads through Telnet and SSH weak-password guessing and a set of known IoT remote-code-execution flaws in routers, gateways, and cameras. One example present in both published lists is CVE-2025-9528, a Linksys E1700 command-injection flaw disclosed in August 2025 with a public exploit.

The vendor did not respond to the original report. NVD's CVSS vector rates the flaw as requiring high privileges, and neither publication explains how it fits the botnet's propagation chain.

A comparison by The Hacker News found that XLab's post and a mirrored CNCERT notice publish different vulnerability lists despite presenting the same joint research. Both agree that weak Telnet and SSH credentials remain the most consistent way in.

XLab says Dysphoria attacks internet-service and gaming targets almost daily, but it names no victims or measured peaks. The storefront advertises attacks of up to about 4 Tbps for tens to hundreds of dollars, but that is an operator claim, not a measured attack.

Cloudflare measured a 31.4 Tbps attack from the related AISURU/Kimwolf botnet before the March disruption. CNCERT, XLab, and the earlier JackSkid research name no operator. No independent source has measured a Dysphoria attack peak or confirmed the reported 200,000-device scale.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.