- Published on
Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption
- Authors
- Name
- DeepHorus
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. This evolution reflects ongoing cat-and-mouse dynamics between defenders and cybercriminals.
CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese firm Qi'anxin, put its population above 200,000 bots. Their telemetry logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad. However, none of the counts has been independently reproduced, and the researchers published no counting or de-duplication methodology.
The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone. Within days, researchers documented the operator falling back to an Ethereum Name Service (ENS) domain for command-and-control (C2).
XLab's Dysphoria timeline opens with a JackSkid sample captured on March 25 that resolves C2 through the ENS domain m3rnbvs5d[.]eth. Further analysis revealed that blockchain records encode distribution-node IPv4 addresses, and other infrastructure records are supplied via Solana Name Service (SNS). The DDoS sample asks a distribution node for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers.
XLab's analysis, published July 25, tracks a fast run of builds: custom RC4 string encryption and ENS resolution at the end of April, followed by SNS resolution in early May. A relay-only variant appeared on June 25, with UPnP-based port mapping added days later to traverse NAT gateways. This relay-only build drops DDoS modules and instead uses UPnP to map ports and Linux epoll to shuttle traffic.
The shift complicates conventional server seizure but does not remove infrastructure from the chain. Japan's NICT independently documented the same JackSkid-to-ENS/SNS shift in May, and like Nokia and Comcast, found code and strings shared with several other botnet families. That overlap points to shared tooling rather than proof of a single operator.
XLab and CNCERT say Dysphoria spreads through Telnet and SSH weak-password guessing and a set of known IoT remote-code-execution flaws. One example is CVE-2025-9528, a Linksys E1700 command-injection flaw disclosed in August 2025 with a public exploit. Defenders should patch exposed IoT gear, replace unupdatable devices, eliminate default credentials, and disable remote management where not needed.
