Inside the Dysphoria IoT Botnet: How Blockchain-Based C2 Makes 200,000 Infected Devices Nearly Untakedownable

The Botnet That Learned to Hide on the Blockchain

Dysphoria marks a turning point in IoT botnet design. While earlier botnets like Mirai relied on centralized servers and traditional DNS lookups that law enforcement could seize, Dysphoria is the first major botnet to replace that entire infrastructure with blockchain-based name services, a custom cryptographic hiding scheme, and a self-sustaining relay network built from its own victims .

As QiAnXin XLab and CNCERT researchers documented, Dysphoria emerged directly after a March 2026 multinational law enforcement operation took down the JackSkid botnet and other major networks . Rather than simply rebuilding what was lost, the operators designed a fundamentally harder-to-disrupt architecture.

How It Works: Blockchain Name Resolution and Encrypted C2

The core innovation is the use of Ethereum Name Service (ENS) and Solana Name Service (SNS) domains to locate command-and-control infrastructure. Instead of registering a DNS domain that can be seized, the botnet stores C2 information in blockchain TXT records that no single entity controls .

Fake IPv6 String Decoy

C2 addresses are embedded inside fake IPv6 addresses—for example, 2001:db8:12e7:13d7::1—stored in ENS/SNS TXT records. The malware extracts only a 4-byte key from the string and runs it through a custom permutation function F() to recover the real IPv4 address [Primary XLab report].

Custom Byte-Transformation Algorithm

The decryption uses a heavily modified RC4 cipher with two Key Scheduling Algorithm (KSA) rounds: standard RC4 plus an LCG-based S-box shuffle. The Pseudo-Random Generation Algorithm (PRGA) stage mixes in a Linear Feedback Shift Register (LFSR) step and complex bit-rotations. XLab published a full Python-reproducible algorithm for researchers [Primary XLab report].

Two-Stage C2 Resolution

The DDoS sample first queries an ENS/SNS domain (e.g., burrberry.eth) to retrieve a block of relay-node IPs. It then contacts those relays via

GET /nodes?key=meowmeowmeow

Rapid Evolution From March to June 2026

The botnet underwent frequent, documented iterations over just three months [Primary XLab report]:

"hail china mainland"

Propagation Methods

Dysphoria spreads mainly through Telnet and SSH credential brute-forcing, but it also exploits at least 14 known remote-code-execution (RCE) vulnerabilities targeting routers, cameras, and embedded Linux devices [Primary XLab report]. The exploited CVEs range from long-standing IoT flaws (CVE-2017-17215, CVE-2020-8515) to recently disclosed vulnerabilities (CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182), confirming active maintenance [Primary XLab report].

Why Dysphoria Is Much Harder to Disrupt

Three interlocking design choices break the classic takedown playbook:

1. Blockchain-based name resolution (ENS + SNS) – C2 domains are registered on public blockchains, not on DNS infrastructure that law enforcement can seize. TXT records are immutable once written, and the operator can simply update the record without touching any server [Primary XLab report].
2. Encrypted, algorithm-protected configurations – C2 addresses are never stored in plaintext. They are wrapped in fake IPv6 strings, encrypted with a custom RC4-variant cipher, and can only be decoded by running the exact byte-transformation algorithm hard-coded into each sample [Primary XLab report].
3. Distributed relay mesh from infected devices – Since late June, the botnet no longer depends on a fixed set of operator-owned servers. Attack commands flow through a network of compromised devices that act as bidirectional, epoll-driven relays with UPnP port mapping. Shutting down one relay only causes the DDoS bots to query the blockchain again for a fresh relay list [Primary XLab report].

As XLab and CNCERT concluded, this combination means that taking down any single IP address or domain is ineffective because the C2 layer is cryptographically hidden, the name records are on an immutable blockchain, and the command path runs through hundreds of thousands of rotating, untakedownable home routers [Primary XLab report].