Rebuilt in Six Days: Dysphoria IoT Botnet Hides on Blockchain to Defy Seizure

When U.S., Canadian, and German authorities seized the command infrastructure of four major IoT botnets on March 19, 2026, they dealt what looked like a decisive blow against some of the most destructive distributed denial-of-service networks ever documented — the DOJ disrupted four IoT botnets named Aisuru, KimWolf, JackSkid, and Mossad in a coordinated international operation. Six days later, on March 25, researchers at Chinese cybersecurity firm QiAnXin XLab detected the first samples of a new botnet — one built specifically to make sure the same playbook would never work again.

The new botnet, named Dysphoria, had infected an estimated 200,000 devices worldwide by the time XLab and China's national computer emergency response team CNCERT published their joint technical analysis on July 27, 2026. Its defining innovation: instead of registering conventional internet domains that a court order can seize and redirect, Dysphoria stores its command infrastructure inside Ethereum and Solana blockchain name records — decentralized systems with no registrar to serve notice on and no single server to take offline. That structural choice is not a feature borrowed from older botnets. It is a direct engineering response to watching four predecessor networks die on March 19.

The 200,000-device figure comes from XLab's own telemetry and from leaked screenshots of the Dysphoria operator control panel circulating on social media, which showed a consistent count near that number. As The Hacker News noted in its coverage , XLab published no counting or de-duplication methodology alongside its estimates, and no independent party has reproduced the figures. They should be read as informed estimates, not a precise device census.

The March 2026 operation was genuinely unprecedented in scale. The four botnets targeted — Aisuru, KimWolf, JackSkid, and Mossad — had collectively compromised more than three million devices including consumer routers, digital video recorders, and IP cameras, according to the DOJ press release . Before their disruption, these networks had issued more than 316,000 combined DDoS attack commands. Cloudflare independently measured a peak attack of 31.4 terabits per second from the Aisuru/KimWolf network — a world record at the time. Among the victims was the U.S. Department of Defense Information Network.

Contributing partners in the takedown included Akamai, Amazon Web Services, Cloudflare, Google, and QiAnXin XLab itself — the same firm that is now reporting on Dysphoria, JackSkid's direct successor, as confirmed in the Team Cymru post on the operation .

Dysphoria descends from the JackSkid malware lineage. XLab's timeline begins with a jackskid-based sample captured March 25, 2026, which used an Ethereum Name Service (ENS) domain — m3rnbvs5d.eth — to locate its command infrastructure. The six-day interval between the takedown and the first Dysphoria detection is consistent with an operator who had a backup architecture prepared in advance rather than scrambling after the fact.

To understand why Dysphoria's design is significant, it helps to understand how traditional botnet disruptions work — and why they fail against blockchain infrastructure.

When authorities disrupt a conventional botnet, the key action is domain seizure or sinkholing: law enforcement serves a court order on the domain registrar controlling the botnet's command domains. The registrar redirects traffic from those domains to a controlled server (a "sinkhole"), cutting the botnet operators off from their infected devices. Academic research on this technique confirms it has been the backbone of major botnet disruptions for more than a decade.

Blockchain-based naming services break this mechanism entirely. The Ethereum Name Service stores domain records across every node in the Ethereum blockchain — a distributed network with thousands of participants globally. To seize or modify a blockchain domain record, a defender would need to either take down every machine running an Ethereum node or successfully execute a so-called "51% attack" — seizing control of more than half the computing power in the entire Ethereum network. As the UCSD academic research on this exact problem concludes, neither is operationally feasible. There is no registrar to serve, no hosting provider to , and no single authoritative server to redirect.

Dysphoria uses this property as a resilience layer. Infected devices query ENS domains such as burrberry.eth and ukranianhorseriding.eth , and a Solana Name Service domain, 24carnforth2merseyside.sol , to retrieve the addresses of relay distribution nodes, as detailed in XLab's technical analysis . The blockchain records do not contain plaintext IP addresses. XLab's analysis found the data formatted to resemble IPv6 addresses, with the actual command-server address embedded in specific byte segments and encoded through a custom permutation function involving bit rotation and XOR operations against a fixed key. A defender scanning the blockchain record sees what appears to be a dead IPv6 string rather than an active command endpoint.

The Ethereum and Solana foundations have made no public statement whether they have any mechanism to disable specific domain records used for criminal command infrastructure. Based on publicly available ENS documentation , no such mechanism exists.

The blockchain-based C2 lookup is one layer of a deeper obfuscation architecture. In late April 2026, Dysphoria operators introduced a heavily modified encryption routine for string protection — substantially more complex than a standard RC4 encryption scheme, according to XLab's analysis .

The routine combines three distinct components. It begins with a standard RC4 key-scheduling phase, then adds five consecutive S-box shuffles driven by a Linear Congruential Generator (LCG) — a class of pseudorandom number generator. During the actual output phase, it incorporates a Linear Feedback Shift Register (LFSR) step into keystream generation alongside additional bit-shift and swap operations. The effect is that each encrypted string requires the full custom algorithm to recover, making automatic signature extraction and static analysis substantially harder than for standard RC4 samples. Researchers attempting to analyze samples statically see encrypted data rather than readable configuration strings.

During active execution, Dysphoria masquerades its process name as libdalvikengine.so — a filename that mimics a legitimate Android runtime library — to blend into the running process list on compromised Linux-based IoT devices.

The most architecturally significant development in Dysphoria's four-month evolution arrived in late June 2026: a variant that discards DDoS functionality entirely and converts infected devices into covert traffic relay nodes.

The DDoS variant and the relay variant are now two separate populations of infected devices serving distinct operational purposes. Infected devices running the DDoS variant receive attack commands from the operators — specifying duration, type, target IP addresses and netmasks, and configurable flags — and execute them, per XLab's technical report . Infected devices running the relay variant do something less visible and harder to detect: they forward traffic on behalf of the botnet's control infrastructure, functioning as an anonymizing layer between Dysphoria's real operators and its DDoS bots.

The relay variant achieves this through two mechanisms. First, it abuses Universal Plug and Play (UPnP) — a networking protocol enabled by default on most consumer routers — to create 155 port-forwarding rules on the compromised device's local gateway router. These rules punch holes through the router's NAT configuration, making the compromised internal device reachable from the internet on 155 separate ports. Second, the variant uses Linux's epoll system for asynchronous non-blocking input/output, enabling it to handle large volumes of simultaneous connections efficiently and relay traffic bidirectionally between Dysphoria's DDoS bots and actual command servers.

At intervals of roughly four seconds, each relay node sends a JSON-formatted health report to a heartbeat collection domain, reporting its status, active connection count, and bandwidth usage. The relay nodes themselves are listed in responses from the ENS-resolved distribution node — creating a dynamic, self-updating directory of the botnet's own infrastructure, built entirely from compromised consumer devices.

This bifurcation means that dismantling the DDoS-capable nodes does not eliminate the relay infrastructure, and vice versa. Two separate remediation operations would be required, against a target population that law enforcement has no way to survey comprehensively.

There is a specific risk to device owners from the relay variant that extends beyond the period of active infection: the 155 port-forwarding rules it creates are written to the router's NAT configuration table, and they do not automatically disappear when the malware process is killed or the infected device is rebooted.

UPnP was designed to allow devices on a local network to request port-forwarding rules from the router without requiring authentication — a convenience feature intended to make networking easier. Because the protocol requires no authentication for local-side requests, any process running on a local device can issue UPnP commands to the router. The Akamai UPnProxy research demonstrates how Dysphoria-type malware exploits this to write 155 forwarding rules to the router's memory. When the malware is removed from the infected IoT device, those router-level rules remain in place until explicitly cleared by a user or a router reboot with appropriate configuration.

The practical consequence: a router that hosted a Dysphoria relay node may continue forwarding inbound connections to the previously-compromised device's ports even after the malware is gone, leaving a residual access pathway that a subsequent infection — or a persistent attacker who bookmarked the address — could use. Owners who discover and remove the Dysphoria infection but do not also audit and clear their router's UPnP port-forwarding table have not fully remediated the compromise.

Between July 14 and July 20, 2026, XLab monitored active Dysphoria infections . Within mainland China, 4,401 confirmed active bots were observed over the week, with a daily peak of 1,801. Globally, peak daily C2 access sessions reached 740,000. The overseas bot count, which XLab measured at a peak of 239,000 active simultaneously on a single day, substantially exceeds the Chinese domestic count — a disparity XLab attributes to the relay-conversion architecture, which routes traffic through compromised devices and amplifies the apparent international footprint of the botnet's controlled infrastructure.

These figures are from a single source without published methodology. Their accuracy depends on how many C2 sessions are counted, how XLab handles dynamic IP address churn in networks, and what threshold defines an "active" bot. Readers should treat them as directionally meaningful estimates of scale, not as independently verified counts.

The Dysphoria operators advertise their services on a publicly accessible clearnet site styled as a legitimate stress-testing service. They claim up to 4 terabits per second of DDoS attack capacity, priced in subscription tiers from tens to hundreds of dollars depending on duration and bandwidth. That claimed capacity is substantially lower than the 31.4 Tbps record achieved by the predecessor Aisuru/KimWolf network before its disruption — but it is more than sufficient to take most online services offline. The 4 Tbps figure comes from the operators themselves and has not been independently measured.

Dysphoria spreads through two primary mechanisms: brute-forcing weak or default Telnet and SSH credentials on internet-exposed IoT devices, and exploiting known software vulnerabilities in consumer and small-business hardware, according to XLab's technical report . Its active vulnerability list spans nearly a decade of unpatched devices.

CVE-2025-55182, nicknamed "React2Shell," is a critical remote-code-execution flaw that has already been exploited in ransomware campaigns . CVE-2025-34152 and CVE-2025-28137 target Totolink routers, while CVE-2025-9528 targets Linksys routers. CVE-2020-8515 affects DrayTek devices.

The oldest vulnerability on the list is CVE-2017-17215, a Huawei router flaw disclosed nearly nine years ago. Consumer IoT devices often receive no firmware updates after an initial support period ends, and their owners have no practical mechanism to determine that a device is still receiving security patches. A 2017 vulnerability that is still actively exploited in 2026 is not an outlier — it is the expected result of a consumer electronics market that has no mandatory end-of-life disclosure requirement for firmware support.

The Dysphoria operation is explicitly commercial. Operators sell DDoS attack capacity through a clearnet website in subscription tiers, priced from tens to hundreds of dollars depending on duration and bandwidth — a mature cybercrime-as-a-service model consistent with how the predecessor JackSkid network operated, per the XLab/CNCERT report . The commercial structure creates a recurring revenue incentive for the operators to maintain and grow the botnet's capacity — disrupting the botnet is not only a law enforcement challenge but an economic one for the operators.

No operator has been identified or charged in connection with Dysphoria. The March 2026 operation resulted in the May 2026 arrest of Jacob Butler, 23, the alleged KimWolf operator . The Dysphoria operators remain anonymous.

A distinctive string present in an early Dysphoria sample — "hail china mainland" — appeared in the fbot variant captured April 1, 2026. XLab does not attribute Dysphoria's operation to any specific national actor on the basis of this string. Debug strings left in malware binaries can be inserted deliberately to mislead attribution analysis. No law enforcement agency has publicly attributed Dysphoria to a state or non-state actor.

The combination of blockchain-based C2 and relay architecture means that Dysphoria cannot be disrupted the same way its predecessors were. Until a new takedown framework is developed — one that does not depend on seizing seizeable domains — the only effective protection is hardening individual devices before they are compromised.

XLab and CNCERT recommend the following steps.

Change default credentials on every internet-connected device, particularly routers, cameras, and any device with Telnet or SSH enabled. Default username-password combinations are Dysphoria's primary infection vector.

Disable Telnet and remote management if they are not actively used. Many consumer routers ship with these services enabled by default.

Apply firmware updates immediately. Every vulnerability on Dysphoria's active exploitation list has a vendor patch available. CVE-2017-17215 has had a patch for nearly a decade. Devices that can no longer receive firmware updates should be replaced.

Disable UPnP on your router. This is the step most device guidance omits, and it is the most important one for Dysphoria specifically. The relay-conversion variant creates 155 port-forwarding rules via UPnP, and those rules persist on the router even after the malware is removed from an infected device. Disabling UPnP prevents the variant from writing those rules in the first place, as the UK Government Cyber Security advisory on UPnP details.

Audit and clear existing UPnP port-forwarding rules. Access your router's administration interface and check the port-forwarding or virtual server table for unexpected entries. If you find rules you did not create, clear them. This step is required even if you have already patched or replaced an infected device — the router-level rules are separate from the malware on the IoT device itself, as the Akamai UPnProxy research documents.

Check for the Dysphoria relay heartbeat domain. Security teams monitoring enterprise or networks can add login.trees4sale.net and related Dysphoria infrastructure domains to their block lists. Outbound connections to this domain on port 9000 are a strong indicator of relay-variant compromise.

Not with the same methods. The March 2026 operation worked by seizing internet domains and servers that the predecessor botnets used for command-and-control — actions that required court orders served on domain registrars and hosting providers. Dysphoria stores its command-infrastructure addresses inside Ethereum and Solana blockchain name records, which have no registrar to serve and no central server to seize. Academic research on this exact problem concludes that disrupting blockchain-based C2 would require taking down every node in the Ethereum or Solana network, or executing a majority-computing-power attack on one of those blockchains — neither of which is operationally feasible. A new legal and technical framework for blockchain-domain takedowns does not currently exist.

Check your router's UPnP port-forwarding table or virtual server list in the administration interface (typically accessible at 192.168.1.1 or 192.168.0.1). A large number of port-forwarding rules you did not create — particularly 155 rules appearing simultaneously — is a strong indicator that a device on your network was compromised by the relay variant. Also check for outbound connections from devices on your network to login.trees4sale.net on port 9000, which is the relay variant's health-reporting endpoint, as identified in XLab's indicator-of-compromise list .

Dysphoria's relay variant uses UPnP to write port-forwarding rules directly to your router's NAT configuration, not to the infected IoT device itself. Even if you patch or replace the compromised IoT device, those router-level rules remain in place until you clear them manually or reboot the router with a clean configuration. UPnP is enabled by default on most consumer routers and requires no authentication for local-side requests, meaning any process running on a local device — including malware on a single compromised IoT gadget — can modify your router's network configuration without your knowledge, as UpGuard's UPnP security explainer documents.

No evidence of state attribution has been published by any law enforcement agency. QiAnXin XLab and CNCERT, the Chinese government and firm that published this research, did not attribute Dysphoria to any state or non-state actor. A debug string reading "hail china mainland" appeared in an early Dysphoria malware sample, but XLab's analysis does not use this as attribution evidence. Debug strings can be inserted deliberately to mislead researchers. Readers should note that QiAnXin is a Chinese firm with close ties to China's government cybersecurity apparatus, and that the 200,000-device scale figures in this report have not been independently reproduced.