Back Securityaffairs.Co

Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure

Securityaffairs.Co •Pierluigi Paganini • July 28, 2026

Researchers uncovered the 200,000-device Dysphoria botnet, which uses Ethereum and Solana domains to hide its command servers. QiAnXin XLab, jointly with China’s CNCERT, disclosed Dysphoria, a botnet that has compromised roughly 200,000 devices worldwide and uses Ethereum and Solana blockchain domain names to hide its command infrastructure. The botnet evolved from jackskid and fbot malware […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dysphoria Botnet Infects 200,000 Devices Using Blockchain for C2 Operations The Dysphoria botnet has compromised approximately 200,000 devices globally, utilizing a sophisticated command-and-control (C2) infrastructure hidden behind Ethereum and Solana blockchain domains. Originating from the jackskid and fbot malware, it targets IoT devices such as routers and cameras by exploiting weak Telnet and SSH credentials as well as known vulnerabilities like CVE-2020-8515 and CVE-2025-55182. The botnet's operators have demonstrated resilience through frequent updates and iterations, with a peak of 740,000 daily pings recorded. The malware can execute DDoS attacks with a claimed capacity of 4 Tbps, posing a significant risk for disruptions. Researchers from QiAnXin XLab and CNCERT are actively monitoring the botnet's activities and recommend device firmware updates as a preventive measure. 4 sources 71

Extracted Entities

Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure

The full story

Extracted Entities

Attack Types (1)

Companies (3)

Countries (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)