Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Summary

The Dysphoria IoT botnet has evolved its command-and-control infrastructure by integrating blockchain-based name services and utilizing infected devices as relays. This adaptation follows a March law enforcement operation that targeted the related JackSkid botnet, making Dysphoria more resilient to disruption. Researchers estimate its population exceeds 200,000 bots, spreading via weak credentials and known IoT vulnerabilities.

Full text

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption Swati KhandelwalJul 27, 2026Botnet / IoT Security Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese firm Qi'anxin, put its population above 200,000 bots. Their telemetry logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad. None of the counts has been independently reproduced. The researchers published no counting or de-duplication methodology, so the numbers should not be read as a precise device census. Defenders should patch exposed IoT gear, replace devices that can no longer be updated, eliminate default and weak credentials, and disable remote management and UPnP where they are not needed. The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone. Within days, Nokia Deepfield and Comcast's threat lab documented the operator falling back to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for command-and-control (C2). XLab's Dysphoria timeline opens with a JackSkid sample captured on March 25, six days after the disruption, that resolves C2 through the same domain. XLab found that the burrberry[.]eth record encodes distribution-node IPv4 addresses, while 24carnforth2merseyside[.]sol supplies other infrastructure records. The DDoS sample asks a distribution node over HTTP for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers. The design keeps those controllers one step removed from the addresses exposed to bots. The XLab analysis, published July 25, tracks a fast run of builds: custom RC4 string encryption and ENS resolution at the end of April, followed by Solana Name Service (SNS) resolution in early May. A relay-only variant appeared on June 25, with UPnP-based port mapping added days later to traverse NAT gateways. The relay-only build drops the DDoS modules and instead uses UPnP to map ports on the local gateway and Linux epoll to shuttle traffic between an outside connection and a remote C2 service. XLab documented the related Kimwolf botnet using ENS-based C2 late last year. Dysphoria couples the same resolution model with a relay mesh built from its own victims. The shift complicates a conventional server seizure, but it does not remove infrastructure from the chain: the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays. Japan's NICT independently documented the same JackSkid-to-ENS/SNS shift in May, and, like Nokia and Comcast, found code and strings shared with several other botnet families. That overlap points to shared tooling rather than proof of a single operator, and none of the researchers name one. XLab and CNCERT say Dysphoria spreads through Telnet and SSH weak-password guessing and a set of known IoT remote-code-execution flaws in routers, gateways, and cameras. One example present in both published lists is CVE-2025-9528, a Linksys E1700 command-injection flaw disclosed in August 2025 with a public exploit. The vendor did not respond to the original report. NVD's CVSS vector rates the flaw as requiring high privileges, and neither publication explains how it fits the botnet's propagation chain. A comparison by The Hacker News found that XLab's post and a mirrored CNCERT notice publish different vulnerability lists despite presenting the same joint research. Both agree that weak Telnet and SSH credentials remain the most consistent way in. XLab says Dysphoria attacks internet-service and gaming targets almost daily, but it names no victims or measured peaks. The storefront advertises attacks of up to about 4 Tbps for tens to hundreds of dollars, but that is an operator claim, not a measured attack. Cloudflare measured a 31.4 Tbps attack from the related AISURU/Kimwolf botnet before the March disruption. CNCERT, XLab, and the earlier JackSkid research name no operator. No independent source has measured a Dysphoria attack peak or confirmed the reported 200,000-device scale. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  botnet, Cybercrime, ddos, device security, iot security, law enforcement, Malware, network security, Threat Intelligence, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• domain — m3rnbvs5d[.]eth
• domain — burrberry[.]eth
• domain — 24carnforth2merseyside[.]sol
• cve — CVE-2025-9528

Entities