Dysphoria Botnet Moves C2 to Ethereum and Solana Name Services

CNCERT, China's national CERT, and XLab, the threat-intelligence lab of Qi'anxin, have published research tracking Dysphoria, an IoT botnet line that re-architected its command-and-control within days of a coordinated law-enforcement operation against a related botnet, JackSkid. The redesign is a useful case study in how quickly DDoS-for-hire operators adapt once their infrastructure gets seized — and why domain takedowns alone are a shrinking lever against this class of threat.

What changed after the JackSkid takedown

On March 19, US, German, and Canadian law enforcement acted against four IoT botnets. Court documents cited in the research attribute more than 90,000 DDoS commands to JackSkid alone. According to XLab, the first Dysphoria sample appeared just six days later, on March 25, already resolving its C2 address through an Ethereum Name Service (ENS) domain rather than a registrar-issued one. Over the following months the operator layered in custom RC4 string encryption (late April) and added a Solana Name Service (SNS) domain as a second resolution path (early May).

The practical effect: instead of a DNS record or IP a defender or law-enforcement partner can request be seized or sinkholed, the bot resolves an on-chain name record. Taking that down means contending with a public blockchain's write history rather than a single registrar or hosting provider — a meaningfully higher bar for disruption.

Relays put another hop between researchers and the real controller

In late June, XLab observed a relay-only Dysphoria variant that uses UPnP-based port mapping to punch through NAT gateways and Linux epoll to shuttle traffic between bots and the actual controller. The effect is the same logic long used by proxy botnets and residential-proxy networks: infected devices absorb the researcher- and law-enforcement-facing traffic, while the operator's real infrastructure stays a step removed from any address a defender can observe from the bot side.

Same old entry points

For all the C2 novelty, initial access still runs through familiar, unglamorous weaknesses: routers, gateways, and cameras with known remote-code-execution bugs, plus Telnet/SSH weak-password attacks against devices that were never patched. One example cited is CVE-2025-9528, a command-injection flaw in the Linksys E1700's systemCommand function, publicly disclosed with working exploit code in August 2025 — the vendor never responded to the report, per the GitHub Advisory. That combination — a public exploit against unpatched consumer hardware and no vendor fix in sight — is exactly the gap botnet operators are built to exploit at scale.

Why this matters beyond one botnet

Blockchain-resolved C2 isn't unique to Dysphoria — the researchers note overlapping code and infrastructure with other ENS-using botnets, including one tied to a since-mitigated 31.4 Tbps DDoS attack. That pattern suggests shared tooling circulating among several operators rather than a single actor's one-off trick. For network defenders, the operational takeaway is that domain-based blocking and takedown requests are losing ground against C2 that never touches conventional DNS, which puts more weight on device-level controls: patching or replacing end-of-life IoT hardware, disabling UPnP on gateways where it isn't needed, and closing Telnet/SSH exposure rather than relying on reactive domain blocklists.

FAQ