Dysphoria IoT Botnet Hijacks Devices Worldwide

A rapidly evolving IoT botnet named Dysphoria has infected an estimated 200,000 devices worldwide. Consequently, defenders must understand its blockchain-based command-and-control architecture and aggressive DDoS capabilities. The botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and IoT gateways.

What Happened: Dysphoria Botnet Hijacks 200,000 IoT Devices for DDoS and Traffic Relay

Dysphoria is an Internet of Things botnet line tracked by CNCERT and XLab. It emerged shortly after a March 2026 law-enforcement operation disrupted the JackSkid infrastructure. Moreover, researchers captured a JackSkid sample on March 25 that resolved command-and-control through the Ethereum Name Service domain m3rnbvs5d.eth.

Since then, Dysphoria has undergone rapid technical iteration. In addition, the botnet adopted multi-chain blockchain name services, custom RC4 string encryption, and victim-device relay meshes. Furthermore, a relay-only variant appeared on June 25 that drops DDoS modules and instead transforms compromised devices into network proxies.

Technical Details of the Dysphoria Botnet

Dysphoria’s command-and-control infrastructure relies on blockchain-based name services. Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure records. For example, the burberry.eth record encodes distribution-node IPv4 addresses. Also, the 24carnforth2merseyside.sol domain supplies additional infrastructure records.

C2 addresses are concealed inside fake IPv6 strings. Therefore, infected devices recover them using a custom byte-transformation algorithm. The DDoS variant asks a distribution node over HTTP for a current server list. Moreover, the listed endpoints are infected machines relaying traffic to the real controllers.

Propagation Methods and Infection Vectors

Dysphoria spreads through several well-documented vectors:

• Weak Telnet and SSH credential brute-forcing
• CVE-2025-9528: Linksys E1700 command-injection flaw
• CVE-2025-55182: React2Shell remote code execution vulnerability
• CVE-2025-34152 and CVE-2025-28137: Totolink router flaws
• CVE-2017-17215: Huawei router vulnerability
• CVE-2020-8515: DrayTek router weakness

DDoS and Relay Capabilities

Infected clients send a fixed 78-byte login and heartbeat packet back to the C2. Also, the operator receives DDoS attack commands that include duration, type, targets, and configurable flags. The relay-only variant uses UPnP to create 155 port forwarding rules on the compromised device. Therefore, internal services become exposed to inbound internet connections.

Business and Operational Impact

The Dysphoria botnet poses significant risks to organizations and service providers. First, its claimed maximum DDoS capacity reaches 4 Tbps. Furthermore, the botnet targets internet-service and gaming targets almost daily according to XLab telemetry.

Organizations should consider these impact categories:

• Service disruption: DDoS attacks can overwhelm bandwidth and application layers
• Compromised IoT devices: Home and business routers, cameras, and gateways become attack platforms
• Traffic relay abuse: Infected devices may route malicious traffic for other criminal operations
• Reputational damage: Organizations running compromised devices may be blacklisted
• Regulatory exposure: Unpatched vulnerable devices may violate security standards

Between July 14 and 20, CNCERT and XLab logged 4,401 confirmed active devices inside China. Moreover, they observed a single-day peak of 239,000 bots abroad. However, these counts have not been independently reproduced.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Patch exposed IoT gear and apply all vendor security updates immediately
2. Replace devices that can no longer receive firmware updates
3. Change default administrator passwords on all network equipment
4. Disable remote management interfaces where they are not required
5. Turn off Universal Plug and Play on routers and gateways

Network Monitoring and Detection

Security teams should monitor for suspicious Telnet and SSH brute-force attempts. Also, watch for unexpected UPnP port mapping activity and outbound connections to blockchain name service resolution endpoints. Furthermore,流量 anomalies from IoT device subnets warrant immediate investigation.

Bottom line: Dysphoria demonstrates how quickly botnet operators adapt after law-enforcement disruption. Organizations must patch vulnerable IoT devices, eliminate weak credentials, and disable unnecessary remote access to avoid becoming part of the problem.

Incident Summary

Incident:	Dysphoria IoT Botnet
Affected Systems:	Routers, cameras, IoT gateways, Linux-based embedded devices
Disclosure Date:	July 25, 2026 (XLab analysis)
Patch Status:	Vendor patches available for known CVEs; no universal fix
Estimated Infections:	~200,000 devices (XLab estimate)
Claimed DDoS Capacity:	Up to 4 Tbps

References

1. Bill Toulas, “New Dysphoria DDoS botnet spreads to 200k devices worldwide,” BleepingComputer, July 27, 2026, https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/, accessed July 28, 2026.
2. The Hacker News, “Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption,” July 27, 2026, https://thehackernews.com/2026/07/dysphoria-iot-botnet-adds-blockchain-c2.html, accessed July 28, 2026.
3. XLab, “Dysphoria IoT Botnet Analysis,” Qi’anxin XLab Blog, July 25, 2026, https://blog.xlab.qianxin.com/dysphoria/, accessed July 28, 2026.
4. Nokia Deepfield and Comcast Threat Lab, “JackSkid Botnet Disruption Report,” GitHub, March 2026, https://github.com/deepfield/public-research/blob/main/jackskid/report.md, accessed July 28, 2026.
5. Japan NICT, “JackSkid ENS/SNS Shift Analysis,” NICter Blog, May 2026, https://blog.nicter.jp/2026/05/jackskid_2026_may/, accessed July 28, 2026.