Dysphoria Botnet: A Rapidly Evolving IoT Threat Leveraging Blockchain and Decentralized C2
A sophisticated IoT botnet named Dysphoria has emerged as a major global cybersecurity threat, employing blockchain-based domain resolution and a hybrid command-and-control (C2) architecture to sustain large-scale DDoS operations. First observed by XLAB in Q1 2026, the botnet has undergone aggressive evolution, transitioning from early variants derived from jackskid to more advanced fbot-based implementations within weeks.
Key Developments and Technical Innovations
- Early Variants (March 2026): Initial samples used Ethereum Name Service (ENS) domains (e.g., m3rnbvs5d.eth) to fetch configuration data, with debug strings like “android has no compatible libc library.”
- April 2026: Newer variants introduced custom RC4-based encryption with Linear Congruential Generator (LCG) shuffling and Linear Feedback Shift Register (LFSR) operations, complicating reverse engineering. Operators expanded ENS usage (e.g., ukranianhorseriding.eth, burrberry.eth) and adopted Solana Name Service (SNS) domains (e.g., 24carnforth2merseyside.sol) for dynamic C2 infrastructure delivery.
- Covert C2 Resolution: Instead of hardcoded servers, infected nodes query ENS/SNS TXT records, extracting obfuscated IP data disguised as fake IPv6 strings. A custom permutation routine reconstructs valid IPv4 addresses, which are used to contact intermediate distribution nodes (e.g., /nodes?key=meowmeowmeow), masking the true C2 servers behind compromised devices.
- Relayization (Late June 2026): A critical shift saw newer variants removing DDoS capabilities entirely, instead functioning as relay/proxy nodes. These exploit UPnP to open up to 155 ports on infected routers, bypassing NAT restrictions via Linux epoll-based asynchronous I/O for high-efficiency bidirectional tunnels.
- Modular Architecture: Dysphoria separates attack execution from infrastructure support, mirroring trends in crimeware-as-a-service (CaaS) ecosystems. Heartbeat reports (e.g., login.trees4sale.net) provide real-time metrics like bandwidth and connection counts, turning infected hosts into distributed assets.
Propagation and Scale
- Exploited Vulnerabilities: Dysphoria targets a mix of legacy and recent IoT flaws, including:
- CVE-2017-17215 (Huawei HG532e RCE)
- CVE-2020-8515 (DrayTek Vigor RCE)
- CVE-2022-35733 (TP-Link Archer RCE)
- CVE-2025-9528 & CVE-2025-55182 (newer disclosures)
- Primary Infection Vector: Telnet/SSH brute-force attacks remain dominant, targeting routers, cameras, and embedded Linux systems.
- Botnet Size: As of July 2026, Dysphoria has amassed over 200,000 compromised devices, with peak daily C2 sessions reaching 740,000 and 239,000 overseas nodes observed in telemetry (July 14–20, 2026).
- DDoS-for-Hire Services: Leaked backend panels confirm tiered pricing models, with operators advertising up to 4 Tbps attack capacity. Targets include gaming platforms, internet services, and high-availability sectors, with near-daily attack activity.
Impact and Significance
Dysphoria represents a notable shift in botnet design, integrating:
- Blockchain-based C2 resolution (ENS/SNS) for decentralized infrastructure.
- Relay-based obfuscation to evade takedowns.
- Continuous variant iteration to complicate detection.
Its modular separation of attack and infrastructure, combined with aggressive exploitation of IoT vulnerabilities, underscores the growing convergence of decentralized technologies and cybercrime. Traditional mitigation strategies face challenges due to Dysphoria’s dynamic C2 resolution and resilient proxy network.
Indicators of Compromise (IOCs):
- Hostnames: i.peer4you[.]net, login.trees4sale[.]net, c2.saintpetersburgresident[.]ru, node.androiddebugbridge[.]su (among others).
Source: https://gbhackers.com/dysphoria-iot-botnet/
Huawei cybersecurity rating report: https://www.rankiteo.com/company/huawei
TP-Link Research America Corp. cybersecurity rating report: https://www.rankiteo.com/company/tp-link-research-america
"id": "HUATP-1785227245",
"linkid": "huawei, tp-link-research-america",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Technology',
'Internet Services',
'Gaming'],
'location': 'Global',
'type': 'IoT Devices (Routers, Cameras, Embedded Linux '
'Systems)'}],
'attack_vector': ['Telnet/SSH brute-force',
'Exploited vulnerabilities (CVE-2017-17215, CVE-2020-8515, '
'CVE-2022-35733, CVE-2025-9528, CVE-2025-55182)'],
'data_breach': {'data_encryption': 'Custom RC4-based encryption with LCG '
'shuffling and LFSR operations'},
'date_detected': '2026-03-01',
'date_publicly_disclosed': '2026-07-01',
'description': 'A sophisticated IoT botnet named Dysphoria has emerged as a '
'major global cybersecurity threat, employing blockchain-based '
'domain resolution and a hybrid command-and-control (C2) '
'architecture to sustain large-scale DDoS operations. The '
'botnet has undergone aggressive evolution, transitioning from '
'early variants derived from jackskid to more advanced '
'fbot-based implementations. It uses Ethereum Name Service '
'(ENS) and Solana Name Service (SNS) domains for dynamic C2 '
'infrastructure, custom encryption, and modular architecture '
'separating attack execution from infrastructure support. '
'Dysphoria targets IoT devices via brute-force attacks and '
'exploits multiple vulnerabilities, amassing over 200,000 '
'compromised devices and offering DDoS-for-hire services with '
'up to 4 Tbps attack capacity.',
'impact': {'operational_impact': 'Large-scale DDoS attacks targeting gaming '
'platforms, internet services, and '
'high-availability sectors',
'systems_affected': 'Over 200,000 IoT devices (routers, cameras, '
'embedded Linux systems)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Dysphoria highlights the growing convergence of '
'decentralized technologies (blockchain-based C2) and '
'cybercrime, complicating traditional mitigation '
'strategies due to dynamic C2 resolution and resilient '
'proxy networks.',
'motivation': ['Financial gain (DDoS-for-hire)',
'Cybercrime-as-a-Service (CaaS)'],
'post_incident_analysis': {'corrective_actions': ['Patch management for IoT '
'devices',
'Disable Telnet/SSH where '
'unnecessary',
'Monitor for '
'blockchain-based C2 '
'activity'],
'root_causes': ['Exploitation of unpatched IoT '
'vulnerabilities',
'Brute-force attacks on Telnet/SSH '
'services',
'Use of decentralized C2 '
'infrastructure (ENS/SNS) to evade '
'takedowns']},
'recommendations': ['Enhance monitoring for IoT device vulnerabilities and '
'brute-force attacks',
'Implement network segmentation to limit lateral movement',
'Deploy adaptive DDoS mitigation strategies',
'Monitor blockchain-based domain services (ENS/SNS) for '
'malicious activity',
'Update IoT devices to patch known vulnerabilities'],
'references': [{'date_accessed': '2026-07-01', 'source': 'XLAB'}],
'title': 'Dysphoria Botnet: A Rapidly Evolving IoT Threat Leveraging '
'Blockchain and Decentralized C2',
'type': 'Botnet, DDoS, IoT Exploitation',
'vulnerability_exploited': ['CVE-2017-17215',
'CVE-2020-8515',
'CVE-2022-35733',
'CVE-2025-9528',
'CVE-2025-55182']}