# Dysphoria Botnet Puts Its Command Infrastructure on the Blockchain — and That's Why It's Hard to Kill
Seize the domain. Sinkhole the IP. Suspend the account. These have been the standard playbook moves for botnet takedowns for fifteen years, and they've worked often enough that law enforcement and security vendors treat them as reliable tools. Dysphoria, a newly documented botnet that has swept up roughly 200,000 devices worldwide, is built around a simple premise: what if those moves don't work?
The answer, according to researchers at QiAnXin XLab who published their analysis this week, is a botnet that has grown to significant scale in under four months and is still iterating.
## The Architecture That Makes It Resilient
Dysphoria didn't emerge from nothing. It evolved from two older malware lineages — jackskid and fbot — by grafting a novel command-and-control mechanism onto their foundations. Instead of pointing infected bots at a conventional domain or hardcoded IP, the malware resolves its C2 infrastructure through Ethereum's ENS (Ethereum Name Service) and Solana's SNS (Solana Name Service) — decentralized naming systems that no registrar, no court order, and no ISP can simply suspend.
The concealment goes a layer deeper. The actual C2 addresses aren't stored openly; they're embedded inside fake IPv6 strings and recovered by a custom byte-transformation algorithm running on the infected device itself. To an analyst watching network traffic, the lookup looks like noise.
Once a bot connects, the protocol is lean: a fixed 78-byte packet handles login and heartbeat. Attack commands come back specifying duration, type, target, and configurable flags. Simple, efficient, hard to disrupt at the infrastructure layer.
XLab first spotted Dysphoria on March 25. In the months since, they've tracked multiple variant iterations adding meaningful functionality: multi-chain support, new ENS/SNS domains, and — most interesting from an operational security standpoint — a functional split between the DDoS capability and a separate relay network variant.
## The Proxy Pivot
In late June, XLab documented a Dysphoria variant that dropped DDoS functionality entirely. Instead, it converts infected devices into anonymous proxy nodes.
The mechanism is UPnP abuse — the malware exploits Universal Plug and Play to create 155 port forwarding rules on each compromised device, exposing internal services to inbound internet connections. A router that was running DDoS flood traffic last month becomes an anonymous network relay this month.
This matters more than the DDoS headline. A 200,000-node proxy network is a different kind of weapon. It can launder the origin of targeted intrusion traffic, bypass geo-restrictions, support credential-stuffing campaigns, and route nation-state reconnaissance through residential and small-business IP addresses in over a hundred countries. The DDoS capacity — operators advertise 4 Tbps on a clearnet site framed as a "stress-testing" service — is the visible, flashy offering. The proxy network is the quieter, more persistent business.
## What It's Actually Breaking In To
The infection chain is depressingly familiar: weak or default Telnet and SSH credentials, combined with unpatched vulnerabilities in consumer routers, IP cameras, and assorted IoT devices. The recently exploited flaws include CVE-2025-55182 (a React2Shell vulnerability), CVE-2025-28137 in Totolink gear, and CVE-2025-9528 affecting Linksys.
But buried in XLab's CVE list are two that should cause genuine frustration: CVE-2017-17215, a Huawei HG532 vulnerability that is nine years old, and CVE-2020-8515, a DrayTek flaw from 2020. These are not zero-days. They are not sophisticated. They are vulnerabilities with published patches that millions of deployed devices simply never received — because their owners never applied them, or because the devices stopped receiving updates years ago.
This is the quiet scandal underneath every major IoT botnet story. Dysphoria's operators didn't need to discover anything. They needed to point a scanner at the internet and wait.
Between July 14 and 20, XLab recorded a peak of 740,000 daily pings from infected hosts. The geographic spread is wide, with 239,000 connections from overseas clients versus 1,800 from China. The infection base is global and diffuse — exactly the profile that makes coordinated takedown difficult.
## For Defenders: What Actually Matters Here
The standard remediation advice is valid and worth repeating: update firmware, change default passwords, disable Telnet and SSH remote access if you don't use them. But that advice has been repeated for a decade while botnets like this one keep growing, so it's worth being direct about what's actually broken.
Enterprise and SMB network teams need to audit what IoT and edge devices are on their networks and what those devices are doing. UPnP should be disabled on anything where it isn't explicitly required — the protocol's convenience is routinely weaponized against the networks that enable it.
ISPs and managed service providers are in the best position to detect the anomalous traffic patterns Dysphoria generates. The 78-byte heartbeat packets and the UPnP-driven port-forwarding behavior are detectable at the network layer. Most consumer ISPs don't look.
Security operations teams should note the blockchain C2 pattern specifically. Threat intelligence feeds that rely on domain or IP blocklisting will be slower to catch Dysphoria-family infections than behavioral detection. Hunting for the ENS/SNS resolution patterns and anomalous UPnP activity is more reliable than waiting for a feed update.
---
## HackWire Analysis
Dysphoria is worth watching not because of its size — 200,000 bots is significant but not unprecedented — but because of what its blockchain C2 architecture signals about where botnet development is heading.
The traditional takedown playbook assumes there are chokepoints: a domain registrar that can suspend, a hosting provider that can terminate, a bulletproof provider that can eventually be pressured. Decentralized naming systems eliminate the registrar. ENS domains are owned by whoever holds the private key; there is no abuse desk to call. This isn't a theoretical evasion technique anymore — it's deployed infrastructure that has been running for months.
What makes this particularly concerning is the iteration speed XLab documents. Multiple meaningful variant updates in under four months — adding multi-chain support, splitting DDoS and proxy functionality into separate operational tracks — suggests operators who are actively developing and testing, not running static tooling. The July peak of 740,000 daily pings from 200,000 devices means a significant fraction of those devices are checking in multiple times per day, keeping the botnet operationally fresh.
The comparison to Aisuru/Kimwolf's 31.4 Tbps record is less important than the trend it represents. Botnet operators are building for resilience and flexibility, not just raw throughput. A 4 Tbps DDoS capability that can pivot to a 200,000-node anonymous proxy network on operator command is a more dangerous tool than a pure-volume DDoS cannon.
The nine-year-old Huawei CVE sitting in Dysphoria's arsenal tells you everything about the state of IoT security economics. Patching consumer edge devices is essentially a voluntary act with no enforcement mechanism, and the security debt accumulated over the last decade is now sitting on the open internet waiting to be recruited.
Defenders who haven't audited their IoT attack surface in the last year are overdue. Dysphoria's operators already have.
— HackWire Editorial
---
## Related Coverage