# Dysphoria Botnet Rewires Its Command Chain With Blockchain DNS and Victim Relays


## The Threat


When U.S., German, and Canadian law enforcement dismantled JackSkid infrastructure on March 19, 2026, the disruption lasted roughly six days. By March 25, a descendant botnet — now tracked as Dysphoria — had already adopted a new command-and-control architecture built around blockchain name resolution and a relay mesh constructed from its own victims. That pivot, documented by China's CNCERT and threat-intelligence firm XLab, represents a meaningful operational evolution for commodity IoT botnets and a direct counter to the seizure-and-sinkhole playbook that has driven most recent botnet takedowns.


The architecture works like this: instead of hardcoding C2 server IPs or pointing to a domain registrar that can be compelled to act, Dysphoria resolves its controllers through Ethereum Name Service (ENS) and Solana Name Service (SNS) records. Blockchain records are effectively outside the reach of a court order directed at a traditional registrar. From there, commands route through a layer of infected machines — ordinary routers, gateways, and cameras that victims don't know are acting as relays — before reaching the real controller. The actual controller IPs are never directly visible to the botnet's infection layer.


The build cadence after the JackSkid disruption is striking. Custom RC4 string encryption and ENS resolution appeared by late April. SNS support followed in early May. A relay-only variant dropped June 25, with UPnP-based NAT traversal added within days. Three months of active development, post-seizure, by an operator who clearly anticipated what would come next.


## Severity and Impact


This reporting does not describe a single CVE driving mass compromise. The botnet's primary propagation vectors are weak credentials and a mix of known IoT flaws, with one example publicly disclosed:


| CVE | Description | CVSS Score | Vector | Attack Complexity | Privileges Required |

|---|---|---|---|---|---|

| CVE-2025-9528 | Linksys E1700 command injection | Not fully published | Network | Low | High (per NVD) |

| Multiple unlisted | IoT router/gateway/camera RCE | Varies | Network | Low | None (default creds) |


Note: NVD's CVSS vector for CVE-2025-9528 lists high privilege requirements, but neither XLab nor CNCERT explain how this flaw fits the botnet's unauthenticated propagation chain. The discrepancy is unresolved. The Linksys vendor did not respond to the original disclosure report.


XLab and CNCERT estimate the active botnet population above 200,000 devices, with a single-day peak of 239,000 bots observed abroad and 4,401 confirmed active devices in China between July 14 and 20. Neither organization published counting or de-duplication methodology, so treat these as directional figures rather than a device census.


## Affected Products


Dysphoria targets internet-exposed IoT devices running on default or weak credentials. Known targets span consumer and small-business networking equipment:


  • Routers and gateways — including Linksys E1700 and similar SOHO devices vulnerable to CVE-2025-9528
  • IP cameras — exposed via Telnet or SSH with factory credentials
  • Network-attached devices — any reachable device accepting Telnet or SSH on default ports with weak passwords

    • XLab and CNCERT published different vulnerability lists in their respective notices despite presenting joint research. Both agree weak Telnet and SSH credentials are the most consistent infection vector. The full exploit list has not been reconciled between the two publications.


    ## Mitigations


    Organizations and individuals running internet-connected devices should act on the following, in order of impact:


  • Patch immediately: Apply all available firmware updates to routers, cameras, and gateways. CVE-2025-9528 has no vendor patch for the Linksys E1700 — retire affected devices.
  • Eliminate default credentials: Change all Telnet and SSH passwords on networked devices. If the device does not support credential changes, replace it.
  • Disable remote management where not needed: Turn off Telnet, SSH, and UPnP on devices that don't require remote access. Dysphoria's June relay-only build specifically exploits UPnP to traverse NAT — disabling it removes that vector.
  • Firewall IoT device segments: Place IoT devices on isolated VLANs with no outbound connectivity except to required services. A compromised relay on your network that cannot reach external C2 nodes is a dead relay.
  • Monitor for unusual outbound traffic: Look for IoT devices making persistent outbound connections on unexpected ports, particularly toward blockchain RPC endpoints.
  • Replace end-of-life devices: Any device that can no longer receive firmware updates should be considered permanently compromised. There is no software fix available.

    • ## References


  • XLab threat analysis (Qi'anxin), published July 25, 2026
  • CNCERT joint advisory notice
  • Japan NICT independent documentation of JackSkid-to-ENS/SNS shift (May 2026)
  • Nokia Deepfield and Comcast threat lab reporting on ENS fallback post-disruption
  • NVD entry: CVE-2025-9528
  • ENS domain of record: m3rnbvs5d[.]eth
  • SNS domain of record: 24carnforth2merseyside[.]sol

    • ---


    ## HackWire Analysis


    The Dysphoria story is being reported primarily as a botnet-size story — 200,000 bots, peak of 239,000 — but the numbers are the least interesting part. The architecture is the story.


    Law enforcement has refined its approach to IoT botnet disruption: seize infrastructure, sinkhole domains, cut off C2. That playbook worked against JackSkid. The operator clearly studied it. The ENS/SNS pivot isn't novel in concept — Kimwolf used ENS-based C2 last year — but Dysphoria couples blockchain name resolution with a victim relay mesh in a way that specifically addresses the seizure model. You can't serve a warrant on Ethereum. You can seize relay nodes, but the relay pool is self-replenishing as long as the infection rate stays positive.


    What's worth watching closely: the relay-only variant that appeared June 25. Strip out the DDoS modules, keep only the relay capability, add UPnP NAT traversal. That's not a DDoS tool anymore — that's a persistent proxy infrastructure. Threat actors who need reliable, shifting exit nodes for operations other than DDoS have a potential procurement model here if this infrastructure is ever offered as a service. The pivot from DDoS-primary to relay-capable mirrors what security researchers saw with Glupteba when it adopted its own blockchain persistence mechanism.


    The CNCERT and XLab publication discrepancy — different vulnerability lists from a supposedly joint study — is a quiet warning sign for defenders building blocklists from this research. Do not assume either list is exhaustive. Assume the true exploit set is broader than either publication, and defend accordingly: network segmentation and credential hardening beat CVE-specific patching at the IoT layer anyway.


    The Linksys E1700 angle deserves separate attention. A command-injection flaw with no vendor patch and a public exploit, folded into an active botnet campaign targeting exactly the kind of hardware that small businesses and home offices run. Retire the hardware. There is no other answer.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)