Dysphoria IoT Botnet Uses Blockchain C2 and Infected-Device Relays
Summary
Researchers describe Dysphoria’s spread through weak IoT credentials and flaws, and its use of blockchain records and infected-device relays. Reported bot counts and attack capacity have not been independently verified.
Key points
- Researchers trace Dysphoria’s lineage to JackSkid after a March law-enforcement disruption.
- The botnet uses Ethereum Name Service and Solana Name Service records to resolve command-and-control infrastructure.
- Infected devices relay traffic between bots and controllers, adding a layer that complicates disruption.
- Researchers report propagation through weak Telnet and SSH credentials and known IoT remote-code-execution flaws.
- A relay-only variant uses UPnP port mapping and Linux epoll to forward traffic.
- Reported population and attack-capacity figures have not been independently reproduced; researchers name no operator.
Article Details
- Attack Vectors
- Dysphoria spreads by guessing weak Telnet and SSH credentials on IoT devices.
- The botnet exploits known remote-code-execution flaws in routers, gateways, and cameras; CVE-2025-9528 in the Linksys E1700 is cited as an example, although the article says its role in propagation is unexplained.
- Dysphoria uses Ethereum Name Service and Solana Name Service records for command-and-control resolution.
- Infected devices relay traffic between external connections and remote C2 services, obscuring the controllers behind distribution nodes.
- A relay-only variant uses UPnP port mapping to traverse NAT gateways.
- Defensive Notes
- Patch exposed IoT devices and replace devices that can no longer be updated.
- Eliminate default and weak credentials.
- Disable remote management and UPnP where they are not needed.
MITRE ATT&CK
T1071.001 · Web ProtocolsA DDoS sample uses HTTP to request a current server list from a distribution node.T1090 · ProxyInfected devices relay traffic between bots and the real controllers, keeping the controllers behind a distribution layer.T1110.001 · Password GuessingDysphoria spreads by guessing weak Telnet and SSH passwords on IoT devices.T1190 · Exploit Public-Facing ApplicationThe reported propagation includes exploiting known remote-code-execution flaws in internet-connected routers, gateways, and cameras.T1498 · Network Denial of ServiceDysphoria includes DDoS modules, and XLab says the botnet attacks internet-service and gaming targets.
CVE
Malware
Aisuru#DysphoriaDysphoriaDysphoria is an IoT botnet line that evolved after the March takedown of JackSkid infrastructure, using blockchain-based name services and infected-device relays to make disruption more difficult.JackskidDysphoria is an IoT botnet line that evolved after the March takedown of JackSkid infrastructure, using blockchain-based name services and infected-device relays to make disruption more difficult.Kimwolf#Dysphoria