Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure

Researchers uncovered the 200,000-device Dysphoria botnet, which uses Ethereum and Solana domains to hide its command servers.

QiAnXin XLab, jointly with China’s CNCERT, disclosed Dysphoria, a botnet that has compromised roughly 200,000 devices worldwide and uses Ethereum and Solana blockchain domain names to hide its command infrastructure.

The botnet evolved from jackskid and fbot malware families and has been iterating rapidly since XLab first spotted it in March.

In four months, it added a custom RC4 encryption scheme, multi-chain blockchain C2 resolution, and a separate variant that converts infected devices into covert relay nodes.

“Since the first quarter of 2026, XLAB has been tracking a new botnet family called Dysphoria , with over 200,000 bots . This family has undergone frequent mutations and technological iterations in just a few months, demonstrating remarkable resilience.” reads the report published by QiAnXin XLab. “Its evolution has spanned multiple jackskidvariants fbotand recently introduced a C2 covert resolution mechanism based on blockchain ENS/SNS domains , even beginning to transform victim hosts into C2 relay/proxy nodes”

The blockchain-based C2 mechanism is the technically interesting part. Dysphoria queries ENS domains like burrberry.eth and ukranianhorseriding.eth, plus the Solana domain 24carnforth2merseyside.sol, retrieving TXT records that contain fake IPv6 strings. The real IP addresses are hidden inside those strings and recovered through a custom byte-transformation function, so the attacker’s server address never appears in plain text anywhere in the malware or the DNS traffic.

The string protection uses a heavily modified RC4 algorithm. Standard RC4 initializes its S-box with a key, then generates a keystream. Dysphoria adds two extra phases: a linear congruential generator that shuffles the S-box five times after initialization, and a linear feedback shift register that steps during keystream generation, XORing the output with additional rotations and bit shifts before the final byte is applied.

“The latest fbotvariant of Dysphoria has put considerable effort into string protection.” continues the report. “Its decryption algorithm borrows to some extent from jackskidthe code of [previous variant name – likely a specific code or implementation].

• PRGA stage : Introducing LFSR (Linear Feedback Shift Register) stepping during stream generation and performing complex shift swapping.”
• KSA Phase 1 : Standard RC4 initialization.
• KSA 2nd stage : Introduce the LCG (Linear Congruent Generator) algorithm to shuffle the S-box 5 times consecutively.”

All strings in the malware are encrypted with this scheme, which means a basic strings scan returns nothing useful.

The relay variant that appeared on June 25 is a meaningful escalation. It strips out all DDoS attack modules and focuses entirely on turning the infected device into a hidden relay node. After gaining access, it broadcasts a UPnP discovery request across the local network, finds the gateway router, and maps 155 port forwarding rules.

“Once external traffic (such as front-end requests from an attacker or a DDoS sample) connects to a port on the compromised machine bot:P, the relay sample will:

• At the underlying level, Linux’s high-performance epollasynchronous non-blocking I/O driver is used to bind the connections at both ends, implementing bidirectional non-blocking transparent data relay .
• c2:PInitiate an outbound connection immediately to the actual remote device (on the same port).” states the report.

Every four seconds, each relay node reports its status to a heartbeat collection server at login.trees4sale.net:9000, sending a JSON health report with connection count and bandwidth. The architecture means the attacker’s real C2 address never appears in any DDoS bot’s traffic, because the bots only talk to other infected devices acting as relays.

Between July 14 and 20, XLab recorded peak daily pings of 740,000 from infected hosts, with up to 239,000 overseas devices and 1,801 Chinese devices active per day. The operators claim 4 Tbps of DDoS capacity on their public promotion site, selling attack packages ranging from tens to hundreds of dollars depending on duration and bandwidth, a mature commercial operation with subscription tiers. Dysphoria spreads through weak Telnet and SSH credentials and a range of known vulnerabilities in routers, cameras, and IoT devices, including recent ones like CVE-2025-55182 and older ones like CVE-2017-17215 in Huawei devices that remain unpatched across large device fleets. The FTP banner on the download servers reads: “220 cool ftp server hosted on brian krebs’ giant ass 4head.” Apparently even botnet operators have a sense of humor.

“Regarding DDoS attacks, Dysphoria’s targets are located globally, covering multiple industries including internet services and gaming. The victims are characterized by their wide distribution and broad industry coverage.” concludes the report. “Continuous monitoring shows that its attack activity occurs almost daily, maintaining a high level of activity overall. The attack target trends are as follows:”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Dysphoria Botnet)