IoT botnet Dysphoria has infected over 200,000 devices, hiding command servers on Ethereum and Solana blockchain domains. The botnet family first appeared in the wild in March 2026, and X Lab, the research arm of QAX, has tracked its development since.
X Lab published its findings jointly with the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT). Researchers describe a network built on Linux-based IoT malware code lineages known as jackskid and fbot, which Dysphoria’s authors have reworked repeatedly over months rather than years.
How blockchain domains replace command servers
Most botnets rely on hardcoded IP addresses or domain names for command-and-control (C2), giving defenders a fixed target to seize or sinkhole. Dysphoria queries Ethereum Name Service (ENS) and Solana Name Service (SNS) domains instead, pulling C2 infrastructure details out of TXT records rather than conventional DNS.
The ENS domain burrberry.eth returns relay distribution node addresses through a record labelled “node.” A separate ENS domain, ukranianhorseriding.eth, supplies base network infrastructure through a “network” key. The Solana domain 24carnforth2merseyside.sol, introduced in early May, performs the same function through a “deserialised” record.
Blockchain name registries sit outside conventional takedown processes, and a defender attempting to disrupt this infrastructure has no registrar or hosting provider to serve notice on in the way a standard domain seizure would allow.
The records themselves don’t contain plain IP addresses. X Lab’s analysis found the TXT data formatted to resemble IPv6 addresses, with the actual C2 target embedded across specific byte segments and disguised using a permutation function involving bit rotation and XOR operations against a fixed key.
A sample string decoded during the investigation, 12e7:13d7, resolves to the IPv4 address 144.31.38.215 once processed through the routine. Anyone scanning the record casually sees what looks like a dead IPv6 entry rather than an active command endpoint.
From single malware family to relay network
A jackskid-based sample captured on March 25 linked to a Telegram channel through an ENS domain. By April 1, the fbot variant had replaced it. Late April brought a new RC4-based string encryption scheme alongside the blockchain C2 lookup mechanism, and early May added the Solana domain and its TXT-record distribution method.
June marked the point where the family split in function. On June 25, X Lab captured a sample stripped of DDoS attack code entirely, operating solely as a relay and proxy node. Two days later, the family added UPnP-based automated port mapping and combined DDoS-capable samples with a dynamic list of relay nodes, completing what the report calls a hybrid C2 structure built from both attack tooling and compromised infrastructure repurposed as relay points.
The DDoS-capable variant now uses a custom RC4 decryption routine to protect embedded strings, layering a Linear Congruent Generator into the key-scheduling phase and a Linear Feedback Shift Register into stream generation.
Login and heartbeat packets are both fixed at 78 bytes, distinguished by separate 12-byte magic values, and attack commands carry a nested structure specifying duration, attack type, target IP ranges with netmasks, and a variable set of flags for parameter control.
Turning infected IoT devices into proxy infrastructure
The relay-only variant that appeared in late June has one job: convert an infected device sitting behind home or office network address translation into a usable proxy point for other operators.
Most IoT devices and PCs sit behind NAT and can’t accept inbound connections directly, so the sample broadcasts on the local network looking for gateways that support UPnP, then calls the WAN connection service to open a port on the router automatically. X Lab’s report notes samples opening port 155 specifically during this process.
Once that port is live, the compromised device uses Linux’s epoll asynchronous I/O to bind an inbound connection from an attacker or DDoS client to an outbound connection toward the real target, moving traffic in both directions without buffering the full stream.
The relay node then reports its status, including active connection count and bandwidth usage, to a heartbeat collection domain (login.trees4sale.net) roughly every four seconds in JSON format. A device owner has no obvious sign anything is wrong beyond unexplained bandwidth consumption.
Dysphoria spreads mainly through Telnet and SSH weak-password brute-forcing, combined with known remote code execution vulnerabilities in routers, gateways, and cameras.
X Lab’s vulnerability list spans older IoT flaws that botnets have exploited for years, including CVE-2017-17215 and CVE-2020-8515, alongside more recent disclosures such as CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, and CVE-2025-55182. This mix indicates ongoing maintenance of the propagation code rather than a static exploit chain, with weak credential brute-forcing remaining the more consistent entry point of the two.
Scale and commercial IoT botnet rental model
X Lab’s monitoring recorded 4,401 confirmed active bots inside China between 14-20 July 2026, with a daily peak of 1,801 online and 740,000 C2 sessions on the busiest day. Overseas infections ran larger, with a peak of 239,000 bots online in a single day, a gap the report attributes to the relay conversion mechanism inflating the apparent footprint of controlled infrastructure.
X Lab also cites leaked screenshots of the Dysphoria control panel circulating on social media, showing a consistent bot count near 200,000 that the lab says lines up with its own monitoring figures.
The report notes Dysphoria’s operators advertise DDoS packages on a public page offering up to roughly 4 Tbps of attack capacity, priced from tens to hundreds of dollars depending on duration and bandwidth tier. Targets recorded during the monitoring period span internet services and gaming companies across multiple countries, with attack activity logged on close to a daily basis.
For security teams running exposed IoT or network edge equipment, the practical response starts with the same basics that predate Dysphoria: disable Telnet where it isn’t needed, rotate default SSH credentials, and patch the specific CVE list X Lab identified rather than assuming firmware updates are automatic.
Monitoring outbound UPnP port-mapping requests and unexpected connections to port 9000 on unfamiliar IP ranges would also help to catch the relay behaviour described in the report before a device becomes someone else’s proxy infrastructure.
See also: NETSCOUT expands hybrid DDoS defence for critical infrastructure
Want to learn more about the IoT from industry leaders? Check out IoT Tech Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including AI & Big Data Expo and the Cyber Security Expo. Click here for more information.
IoT News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.