Key Takeaways
- The IoT botnet “Dysphoria” emerged after a March 2025 law‑enforcement takedown of the JackSkid infrastructure and now uses blockchain‑based name services (Ethereum Name Service and Solana Name Service) for command‑and‑control (C2).
- CNCERT and XLab estimate the botnet’s size at >200,000 devices, though the figures are unverified because no counting or de‑duplication methodology was disclosed.
- Dysphoria spreads mainly via Telnet/SSH weak‑password guessing and known IoT remote‑code‑execution flaws (e.g., CVE‑2025‑9528 on Linksys E1700 routers).
- The botnet employs a relay‑only variant that uses UPnP port‑mapping and Linux epoll to forward traffic, keeping the true controllers hidden behind compromised devices.
- Defenders should patch vulnerable IoT equipment, replace end‑of‑life devices, eliminate default/weak credentials, and disable unnecessary remote management and UPnP features.
Background and Emergence
Dysphoria is an IoT botnet lineage that researchers from CNCERT (China’s national computer emergency response team) and XLab (the threat‑intelligence lab of Qi’anxin) first observed after a coordinated U.S., German, and Canadian law‑enforcement operation on 19 March 2025 that dismantled the JackSkid infrastructure. Within days of the takedown, the botnet operators began leveraging an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for C2, as documented by Nokia Deepfield and Comcast’s threat lab. XLab’s timeline shows a JackSkid sample captured on 25 March 2025 that already resolved C2 through the same ENS address, indicating a rapid pivot to blockchain‑based naming.
Scale and Measurement Uncertainty
CNCERT and XLab reported that Dysphoria’s population exceeds 200,000 bots, with telemetry logging 4,401 confirmed active devices inside China between 14 and 20 July 2025 and a single‑day peak of 239,000 bots abroad. However, the researchers published no counting or de‑duplication methodology, and none of the figures has been independently reproduced. Consequently, the numbers should be interpreted as rough estimates rather than a precise census of infected devices.
Propagation Mechanisms
The botnet spreads primarily through Telnet and SSH weak‑password guessing, a classic but still effective vector for IoT compromise. In addition, Dysphoria exploits a set of known IoT remote‑code‑execution (RCE) vulnerabilities affecting routers, gateways, and security cameras. One example appearing in both the CNCERT and XLab vulnerability lists is CVE‑2025‑9528, a command‑injection flaw in Linksys E1700 routers disclosed in August 2025 with a public exploit. Although the vendor did not respond to the original report, the flaw’s CVSS vector indicates it requires high privileges; the exact role it plays in Dysphoria’s infection chain remains unexplained in the publications.
Blockchain‑Based C2 Infrastructure
After the March takedown, Dysphoria abandoned traditional hard‑coded IP C2 servers in favor of blockchain name services. XLab found that the ENS record burrberry[.]eth encodes distribution‑node IPv4 addresses, while a Solana Name Service (SNS) record 24carnforth2merseyside[.]sol holds additional infrastructure pointers. The DDoS malware queries a distribution node over HTTP for an up‑to‑date server list; the returned endpoints are compromised devices acting as relays that forward traffic to the real controllers. This extra hop obscures the true C2 servers from direct observation by the bots.
Evolution of the Botnet Code
XLab’s analysis, published on 25 July 2025, traces a rapid iteration of Dysphoria builds. In late April 2025 the botnet adopted custom RC4 string encryption and ENS resolution. Early May 2025 saw the addition of SNS resolution. A relay‑only variant appeared on 25 June 2025, stripping out DDoS modules and instead using UPnP to map ports on the local gateway and Linux epoll to shuttle traffic between an external connection and a hidden C2 service. The same ENS‑based C2 model was previously observed in the Kimwolf botnet, suggesting shared tooling rather than a single operator.
Defensive Implications
The reliance on blockchain name services and relay‑only nodes complicates traditional disruption tactics such as seizing C2 servers, because the botnet still depends on reachable distribution nodes and compromised relays that are themselves IoT devices. Nevertheless, the infrastructure is not entirely removed from the chain: defenders can still target the underlying vulnerable devices, the UPnP port‑mapping functionality, and the blockchain records that store C2 pointers. Recommended mitigations include patching exposed IoT gear, replacing devices that can no longer receive updates, eliminating default or weak credentials, and disabling remote management and UPnP where they are not required.
Corroborating Evidence and Attribution Ambiguity
Japan’s NICT independently observed the same JackSkid‑to‑ENS/SNS shift in May 2025 and noted code and string overlaps with several other botnet families, indicating possible shared development kits or malware‑as‑a‑service offerings. Neither CNCERT, XLab, nor NICT has identified a specific operator, and the absence of independent measurements of Dysphoria’s attack volume (e.g., peak bandwidth) leaves the claimed capability of “up to about 4 Tbps for tens to hundreds of dollars” unverified. Cloudflare’s measurement of a 31.4 Tbps attack from the related AISURU/Kimwolf botnet prior to the March disruption shows the potential scale of such IoT‑based threats, but no comparable data exist for Dysphoria itself.
Conclusion
Dysphoria exemplifies how threat actors adapt to law‑enforcement pressure by migrating C2 to decentralized, blockchain‑based naming schemes and employing relay meshes built from their own victims. While the botnet’s size and potency remain uncertain due to limited transparent data, its propagation still hinges on well‑known IoT weaknesses—weak credentials and unpatched vulnerabilities. Organizations should prioritize credential hygiene, timely patching, and the reduction of unnecessary attack surfaces such as UPnP and remote management to mitigate the risk posed by Dysphoria and similar evolving IoT botnets.