Inside the Dysphoria IoT Botnet: How Blockchain-Based C2 Makes 200,000 Infected Devices Nearly Untakedownable

How It Works: Blockchain Name Resolution and Encrypted C2

The core innovation is the use of Ethereum Name Service (ENS) and Solana Name Service (SNS) domains to locate command-and-control infrastructure. Instead of registering a DNS domain that can be seized, the botnet stores C2 information in blockchain TXT records that no single entity controls .

Fake IPv6 String Decoy

C2 addresses are embedded inside fake IPv6 addresses—for example, 2001:db8:12e7:13d7::1—stored in ENS/SNS TXT records. The malware extracts only a 4-byte key from the string and runs it through a custom permutation function F() to recover the real IPv4 address [Primary XLab report].

Custom Byte-Transformation Algorithm

The decryption uses a heavily modified RC4 cipher with two Key Scheduling Algorithm (KSA) rounds: standard RC4 plus an LCG-based S-box shuffle. The Pseudo-Random Generation Algorithm (PRGA) stage mixes in a Linear Feedback Shift Register (LFSR) step and complex bit-rotations. XLab published a full Python-reproducible algorithm for researchers [Primary XLab report].

Two-Stage C2 Resolution

The DDoS sample first queries an ENS/SNS domain (e.g., burrberry.eth) to retrieve a block of relay-node IPs. It then contacts those relays via GET /nodes?key=meowmeowmeow to receive the final C2 address list—which itself consists of other infected devices acting as relays [Primary XLab report].

Rapid Evolution From March to June 2026

The botnet underwent frequent, documented iterations over just three months [Primary XLab report]:

Propagation Methods

Dysphoria spreads mainly through Telnet and SSH credential brute-forcing, but it also exploits at least 14 known remote-code-execution (RCE) vulnerabilities targeting routers, cameras, and embedded Linux devices [Primary XLab report]. The exploited CVEs range from long-standing IoT flaws (CVE-2017-17215, CVE-2020-8515) to recently disclosed vulnerabilities (CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182), confirming active maintenance [Primary XLab report].

Why Dysphoria Is Much Harder to Disrupt

Three interlocking design choices break the classic takedown playbook:

1. Blockchain-based name resolution (ENS + SNS) – C2 domains are registered on public blockchains, not on DNS infrastructure that law enforcement can seize. TXT records are immutable once written, and the operator can simply update the record without touching any server [Primary XLab report].
2. Encrypted, algorithm-protected configurations – C2 addresses are never stored in plaintext. They are wrapped in fake IPv6 strings, encrypted with a custom RC4-variant cipher, and can only be decoded by running the exact byte-transformation algorithm hard-coded into each sample [Primary XLab report].
3. Distributed relay mesh from infected devices – Since late June, the botnet no longer depends on a fixed set of operator-owned servers. Attack commands flow through a network of compromised devices that act as bidirectional, epoll-driven relays with UPnP port mapping. Shutting down one relay only causes the DDoS bots to query the blockchain again for a fresh relay list [Primary XLab report].

As XLab and CNCERT concluded, this combination means that taking down any single IP address or domain is ineffective because the C2 layer is cryptographically hidden, the name records are on an immutable blockchain, and the command path runs through hundreds of thousands of rotating, untakedownable home routers [Primary XLab report].