A DDoS botnet dubbed Dysphoria has infected roughly 200,000 devices worldwide, according to researchers at QiAnXin XLab, who say the malware’s use of blockchain-based command-and-control (C2) resolution has given it unusual resilience against disruption.

Dysphoria evolved from the earlier jackskid and fbot malware families. Instead of relying on traditional domains or hardcoded IPs, it retrieves infrastructure information through Ethereum ENS and Solana SNS domain lookups. C2 addresses are further obscured inside fake IPv6 strings and decoded using a custom byte-transformation algorithm, complicating detection and takedown by defenders and registrars alike.

XLab first spotted the botnet on March 25, 2026, and has since tracked multiple iterations that added a refined C2 acquisition algorithm, support for additional blockchains, new domains, and a split between relay-only and DDoS-capable variants. Infected devices send a fixed 78-byte login and heartbeat packet to the C2 and receive back attack commands specifying duration, type, targets, and configurable flags.

In late June, XLab observed a variant that dropped DDoS functionality entirely in favor of turning infected devices into network proxies. That version abuses UPnP to create up to 155 port-forwarding rules, exposing internal services on compromised devices to inbound internet traffic.

Spreading Through Weak Credentials and Known Flaws

Dysphoria spreads primarily through weak Telnet and SSH credentials, alongside known vulnerabilities in routers, cameras, and other IoT devices. Recently exploited flaws include CVE-2025-55182 (dubbed "React2Shell"), CVE-2025-34152, CVE-2025-28137 affecting Totolink devices, and CVE-2025-9528 affecting Linksys hardware. The botnet also continues to exploit older, still-unpatched issues such as CVE-2017-17215 in Huawei devices and CVE-2020-8515 in DrayTek products.

Monitoring conducted between July 14 and 20 recorded a peak of 740,000 daily pings from infected hosts, with 239,000 connections originating overseas and 1,800 from China. Based on this activity, XLab estimates the current infected population at around 200,000 devices.

The operators advertise the botnet publicly on a clearnet website as a legitimate stress-testing service, claiming a maximum DDoS capacity of 4 Tbps. That figure is far below the 31.4 Tbps record set by the Aisuru/Kimwolf botnet in December 2025, but still enough to cause meaningful disruption to targeted networks.

Mitigation

XLab and BleepingComputer recommend that device owners keep firmware updated, change default administrator credentials, disable unnecessary remote access, and tighten available security settings to reduce exposure to Dysphoria and similar IoT botnets.