# Dysphoria Botnet Leverages Blockchain for Enhanced Resilience Following a coordinated law enforcement action in March against the **JackSkid** IoT botnet, a new lineage identified as **Dysphoria** has adopted advanced blockchain-based name services and infected-device relays. This strategic shift aims to bolster the botnet's resilience against traditional disruption efforts, according to research by **CNCERT** and **XLab**.  ## Scale and Scope of the Threat **CNCERT**, China's national computer emergency response team, and **XLab**, the threat-intelligence arm of Chinese firm **Qi'anxin**, estimate the **Dysphoria** botnet's population to exceed 200,000 bots. Their telemetry recorded 4,401 confirmed active devices within China between July 14 and 20, with a single-day peak of 239,000 bots observed internationally. It is important to note that these figures have not been independently verified, and the researchers did not publish their counting or de-duplication methodology. ## The Evolution from JackSkid **Dysphoria** traces its roots to **JackSkid**, one of four IoT botnets targeted in a March 19 operation involving U.S., German, and Canadian law enforcement. Court documents revealed over 90,000 DDoS commands attributed to **JackSkid** alone. Within days of the takedown, **Nokia Deepfield** and **Comcast**'s threat lab documented the operator's fallback to an **Ethereum Name Service (ENS)** domain, `m3rnbvs5d[.]eth`, for command-and-control (C2). **XLab**'s timeline for **Dysphoria** begins with a **JackSkid** sample captured on March 25, which also resolved C2 through this same ENS domain. ## Blockchain-Enhanced C2 and Relay Network **XLab**'s analysis, published on July 25, details the botnet's sophisticated architecture. The `burrberry[.]eth` record encodes IPv4 addresses for distribution nodes, while `24carnforth2merseyside[.]sol` provides other infrastructure records via the **Solana Name Service (SNS)**. The DDoS samples request a current server list from a distribution node over HTTP. Crucially, the listed endpoints are compromised machines acting as relays, shuttling traffic to the actual controllers. This design effectively adds a layer of indirection, shielding the ultimate C2 servers from direct exposure.  The botnet's rapid development includes custom **RC4** string encryption and **ENS** resolution by late April, followed by **SNS** resolution in early May. A relay-only variant emerged on June 25, with **UPnP**-based port mapping added days later to facilitate traversal of **NAT** gateways. This relay-only build foregoes DDoS modules, instead utilizing **UPnP** to map ports and **Linux epoll** to manage traffic between external connections and a remote C2 service. This mirrors the C2 model observed in the related **Kimwolf** botnet, which also used **ENS**-based C2 late last year. While this blockchain and relay-based C2 model complicates conventional server seizures, it does not entirely remove infrastructure from the chain. The botnet remains dependent on blockchain records, reachable distribution nodes, and compromised relays. ## Independent Confirmations and Propagation Methods Japan's **NICT** independently documented the same **JackSkid**-to-**ENS**/**SNS** shift in May, corroborating findings by **Nokia** and **Comcast**. These analyses also noted shared code and strings with other botnet families, suggesting shared tooling rather than a single operator. **XLab** and **CNCERT** report that **Dysphoria** propagates primarily through **Telnet** and **SSH** weak-password guessing, alongside exploiting known IoT remote-code-execution flaws in routers, gateways, and cameras. A notable example cited in both published lists is **CVE-2025-9528**, a **Linksys E1700** command-injection flaw disclosed in August 2025 with a public exploit. The vendor did not respond to the original report, and the **NVD**'s **CVSS** vector rates this flaw as requiring high privileges, leaving the exact fit within the botnet's propagation chain unclear. Despite presenting joint research, **XLab**'s post and a mirrored **CNCERT** notice provide different vulnerability lists. However, both agree that weak **Telnet** and **SSH** credentials remain the most consistent entry points. ## Attack Capabilities and Unverified Claims **XLab** claims **Dysphoria** targets internet-service and gaming sectors almost daily, though no specific victims or measured attack peaks have been named. The botnet's storefront advertises DDoS attacks of up to 4 Tbps for hundreds of dollars; however, this is an operator claim and not a verified measurement. For context, **Cloudflare** measured a 31.4 Tbps attack from the related **AISURU/Kimwolf** botnet before the March disruption. Neither **CNCERT**, **XLab**, nor earlier **JackSkid** research has named an operator, and no independent source has confirmed **Dysphoria**'s reported 200,000-device scale or measured an attack peak. ## Recommendations for Defenders To mitigate the risk posed by **Dysphoria** and similar botnets, IT security professionals and privacy-conscious users should: * Patch exposed IoT devices promptly. * Replace end-of-life devices that no longer receive security updates. * Eliminate default and weak credentials, enforcing strong, unique passwords. * Disable remote management and **UPnP** functionalities where they are not strictly necessary.