Dysphoria Botnet Reaches an Estimated 200,000 Devices, Uses Blockchain-Based C2
Summary
QiAnXin XLab estimates Dysphoria has infected about 200,000 devices. The botnet uses blockchain-based C2 resolution for DDoS and proxy operations, and spreads through weak credentials and known flaws in routers, cameras, and IoT devices.
Key points
- QiAnXin XLab estimates Dysphoria has infected about 200,000 devices worldwide and says it has tracked the botnet since March 25.
- Dysphoria is used for DDoS attacks and proxy relays; a variant observed in late June dropped DDoS functionality and focused on proxying.
- The botnet uses Ethereum ENS and Solana SNS to resolve C2 infrastructure, with C2 addresses concealed in fake IPv6 strings and recovered using a custom byte-transformation algorithm.
- Infected clients send fixed 78-byte login and heartbeat packets to C2 and can receive DDoS commands specifying duration, type, targets, and flags.
- Dysphoria spreads using weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and other IoT devices, including CVE-2025-55182, CVE-2025-34152, CVE-2025-28137, and CVE-2025-9528.
- A proxy-focused variant abuses UPnP to create 155 port-forwarding rules that expose internal services to inbound internet connections.
- XLab recorded a peak of 740,000 daily pings during July 14–20. The operators claim a maximum DDoS capacity of 4 Tbps.
Article Details
- Event Type
- Dysphoria botnet growth and operations
- Impact
- QiAnXin XLab estimates Dysphoria has compromised around 200,000 devices worldwide and is using them for DDoS attacks and proxy relay operations. Its blockchain-based C2 resolution makes the infrastructure harder to trace and disrupt. The operators claim a maximum DDoS capacity of 4 Tbps; this figure is an operator claim, not a confirmed measurement.
MITRE ATT&CK
CVE
CVE-2017-17215However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek).CVE-2020-8515However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek).CVE-2025-28137Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).CVE-2025-34152Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).CVE-2025-55182Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).CVE-2025-9528Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).
Malware
DysphoriaDysphoria is a fast-evolving botnet that has compromised about 200,000 devices worldwide and is being used for DDoS attacks and proxy relay operations.fbotQiAnXin XLab found that it inherits traits from jackskid and fbot while adding blockchain-based C2 resolution through Ethereum ENS and Solana SNS, making it harder to trace and disrupt.JackskidQiAnXin XLab found that it inherits traits from jackskid and fbot while adding blockchain-based C2 resolution through Ethereum ENS and Solana SNS, making it harder to trace and disrupt.
Vendors
DrayTekHowever, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek).HuaweiHowever, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek).LinksysAmong the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).TOTOLINKAmong the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys).