In a stunning display of cybercriminal resilience, researchers from China’s National Internet Emergency Response Center (CNCERT) and QiAnXin XLab have uncovered a rapidly evolving IoT botnet that has already compromised over 200,000 devices globally . Named Dysphoria, this isn’t just another Mirai copycat. It represents a fundamental shift in how botnet operators are building infrastructure to withstand takedown attempts.

The story of Dysphoria is a direct response to law enforcement successes. In March, coordinated actions by the U.S., Germany, and Canada disrupted the notorious JackSkid botnet, which had been linked to over 90,000 DDoS commands . But within days, a successor emerged, leveraging the exact weaknesses that authorities had hoped to exploit.

“The Dysphoria family has undergone frequent variant updates and technical iterations in just a few months, demonstrating extremely strong resilience,” the joint report from CNCERT and XLab states . At its core, the botnet uses blockchain-based domain services like Ethereum Name Service (ENS) and Solana Name Service (SNS) to conceal its command-and-control (C2) servers, making them nearly impossible to seize through traditional means .

A Rapid Evolution: From JackSkid to Dysphoria’s “Final Form”

The timeline of Dysphoria’s development is a masterclass in agile malware engineering. It began just days after the JackSkid disruption .

• March 25, 2026: A JackSkid variant is captured, using the ENS domain m3rnbvs5d.eth .
• April 1: A variant called fbot appears, signaling a change in tactics.
• April 29-30: The introduction of a heavily modified RC4 encryption algorithm to protect its strings and a new mechanism to acquire C2 servers .
• Early May: The botnet becomes multi-chain, adding support for Solana’s SNS (24carnforth2merseyside.sol) alongside ENS .
• June 25 – The Turning Point: A purely “relay/proxy” variant is discovered, stripping out DDoS capabilities entirely .
• June 27-28 – The “Complete Form”: Dysphoria incorporates UPnP-based port mapping for automated NAT traversal and finalizes its hybrid C2 link structure .

This trajectory shows a single-minded focus: survivability.

Anatomy of an Unkillable Botnet

1. Blockchain-Based C2 (The “Unblockable” Phonebook)

Instead of hardcoding IP addresses, Dysphoria queries blockchain records. For example, it looks up the node record for burrberry.eth (ENS) and the deserialized record for its SNS domain . Because these records are stored on a public, immutable ledger, law enforcement and security vendors cannot simply “delete” or seize them.

2. Hiding in Plain Sight with “Fake” Addresses

The extracted data isn’t straightforward. The C2 IP addresses are hidden inside fake IPv6 addresses (e.g., 2001:db8:12e7:13d7::1). The malware uses a custom algorithm to extract specific bytes and decrypt the real IPv4 address . This is paired with a “Frankenstein” version of the RC4 cipher that incorporates Linear Congruential Generators (LCG) and Linear Feedback Shift Registers (LFSR) to thwart static analysis by security researchers .

The Dynamic C2 Flow:

1. The infected bot resolves the ENS domain to get an “IP Distributor Node.”
2. It then makes an HTTP GET request to this distributor: http://<node_ip>:9000/nodes?key=meowmeowmeow .
3. The server returns a list of “real” C2 servers.
4. Crucially, these “real” C2s are actually other infected devices acting as relays .

3. The Victim-Becomes-the-Hunter (Relay Mechanism)

The most diabolical feature of Dysphoria is its ability to turn compromised devices into “proxies” or “relays.” .

When the relay variant infects a device, it uses UPnP (Universal Plug and Play) to open 155 ports on the local router, punching a hole through the firewall . It then sits waiting. When traffic arrives, it uses the Linux epoll system for high-performance, non-blocking I/O to bridge the connection between the external client and the true command server .

Why this is devastating: If you trace the C2 traffic, you don’t find a server in a data center; you find a compromised home router in a suburb. This obfuscates the true threat actor and makes it incredibly difficult to shut down the network without disconnecting innocent users.

4. Rapid Propagation and Infection Scale

Dysphoria spreads via the “usual suspects”: Telnet/SSH weak credential brute-forcing and a laundry list of known IoT vulnerabilities (including CVE-2017-17215, CVE-2020-8515, and CVE-2025-9528) .

The scale is alarming. Between July 14-20, 2026, CNCERT reported:

• 740,000 daily C2 access requests from infected hosts .
• 23.9 million peak daily overseas bot count .
• 4,401 confirmed active bots in China .

The operators claim they can muster 4 Tbps of DDoS firepower, capable of taking down most corporate networks .

10 Recommended Actions for Security Teams

Given this threat, organizations and individuals must move beyond reactive patching.

1. Kill UPnP: If you don’t need UPnP (most enterprise environments don’t), disable it on your routers and firewalls immediately .
2. Enforce Strong Credentials: Implement a policy of complex passwords (16+ characters) for all IoT and network devices, and enforce regular changes .
3. Vulnerability Patching: Conduct a rapid audit of your assets for the CVEs listed in the IOC section, specifically targeting routers and cameras .
4. Block Known IOCs: Implement firewall and DNS sinkhole rules to block the known C2 domains and IPs .
5. Outbound Traffic Monitoring: Alert on traffic to ports 9000 and unusual outbound HTTP GET requests to /nodes?key=meowmeowmeow .
6. Disable Telnet/SSH from WAN: Ensure remote management interfaces for IoT devices are not accessible from the public internet .
7. Network Segmentation: Isolate IoT devices and cameras onto separate VLANs away from critical business data .
8. Process Monitoring: Hunt for processes named libdalvikengine.so on Linux devices—this is Dysphoria’s disguise .
9. Block Blockchain Domains: To prevent the initial C2 handshake, consider blocking DNS queries to .eth and .sol domains or leveraging DNS firewalls that threat intelligence services provide .
10. Update Firmware: Check with your router and camera vendors for the latest firmware, and replace any equipment that is End-of-Life (EoL) .

Conclusion

Dysphoria is a wake-up call. It demonstrates that as law enforcement gets better at disrupting traditional botnets, cybercriminals are getting smarter at designing infrastructure that is immune to conventional takedowns . By leveraging the immutability of blockchain and the unpredictability of peer-to-peer relay nodes, Dysphoria’s operators have created a resilient, adaptable, and highly dangerous botnet.

This is the new face of cybercriminal infrastructure: distributed, decentralized, and disturbingly effective. The only defense is a proactive, hygiene-first approach to securing our increasingly vulnerable IoT landscape.