Listen to this Post
Introduction, A New Generation of Botnets Has Arrived
Cybercriminals are constantly reinventing their tactics, but few malware campaigns have evolved as rapidly as Dysphoria. In just a few months, this botnet has transformed from a relatively ordinary malware family into one of the most technically sophisticated IoT threats observed in 2026. By combining blockchain technology, advanced encryption, and stealth networking, Dysphoria has demonstrated how attackers are adapting faster than traditional defenses.
Researchers from QiAnXin XLab, working together with
This discovery highlights a growing cybersecurity trend where decentralized technologies are being abused by threat actors. While blockchain was originally designed to increase transparency and resilience, malware developers are proving that the same technology can also provide anonymity and persistence for criminal operations.
The Discovery of Dysphoria
A Rapidly Mutating Malware Family
QiAnXin XLab first detected Dysphoria in March 2026. Initially, researchers believed it was simply another evolution of the jackskid and fbot malware families.
However, within only four months, the malware underwent continuous upgrades.
Each version introduced new capabilities including:
Advanced encryption techniques
Blockchain-powered C2 resolution
Improved anti-analysis features
Hidden relay infrastructure
Enhanced bot management
Researchers describe Dysphoria as one of the fastest-evolving botnets currently active.
The Scale of the Infection
Nearly 200,000 Compromised Devices
The botnet currently controls approximately 200,000 compromised systems spread across dozens of countries.
During monitoring between July 14 and July 20, researchers observed:
Around 740,000 daily communications (pings) from infected devices.
Approximately 239,000 overseas devices active each day.
Around 1,801 active devices located inside China.
This level of activity suggests an extremely mature infrastructure operating continuously instead of launching occasional attacks.
Blockchain Becomes the New Command Center
How ENS and SNS Domains Hide Attack Servers
Perhaps the most innovative feature of Dysphoria is its use of blockchain domains.
Instead of embedding hardcoded IP addresses inside the malware, Dysphoria queries decentralized blockchain domains such as:
burrberry.eth
ukranianhorseriding.eth
24carnforth2merseyside.sol
Rather than returning a normal server address, these domains provide TXT records containing fake IPv6-looking strings.
Those strings are meaningless unless processed through
Only after performing several transformations does the malware recover the attacker’s actual server IP.
As a result:
Network monitoring tools never see the real C2.
DNS logs appear harmless.
Malware samples reveal no obvious infrastructure.
Traditional IOC hunting becomes much more difficult.
Advanced RC4 Encryption
Beyond Traditional RC4
Another major enhancement involves the
Traditional RC4 is already considered relatively simple.
Dysphoria transforms it into something much more complex.
Researchers discovered that developers added:
Multiple S-box reshuffling phases
Linear Congruential Generator (LCG)
Linear Feedback Shift Register (LFSR)
Additional XOR operations
Bit shifting
Byte rotation
These layers produce heavily obfuscated encrypted strings.
Even extracting readable strings from the malware becomes nearly impossible.
Simple forensic tools produce almost no useful output.
This significantly slows malware reverse engineering.
The Rise of Relay Nodes
From DDoS Bots to Invisible Infrastructure
On June 25, researchers identified a completely new Dysphoria variant.
Unlike previous versions, this malware does not directly launch DDoS attacks.
Instead, it converts infected devices into anonymous relay servers.
The malware:
Discovers routers using UPnP
Maps approximately 155 forwarded ports
Accepts incoming attacker traffic
Transparently forwards communications
Hides the actual command server
This creates multiple layers between attackers and victims.
Investigators attempting to trace attacks only discover other infected devices rather than the real operators.
Heartbeat Monitoring Keeps the Botnet Alive
Continuous Status Reporting
Every four seconds, each infected relay contacts a heartbeat server.
It sends JSON reports containing:
Connection count
Available bandwidth
Health status
Activity metrics
This allows operators to monitor the health of hundreds of thousands of compromised devices in real time.
The result resembles commercial cloud infrastructure rather than traditional malware.
Massive Commercial DDoS Operations
Cybercrime as a Subscription Business
Researchers discovered that Dysphoria operators openly advertise their services.
The botnet reportedly offers:
Up to 4 Tbps DDoS attack capacity
Multiple pricing tiers
Subscription packages
Various attack durations
Bandwidth-based plans
This demonstrates how cybercrime increasingly resembles legitimate Software-as-a-Service (SaaS) businesses.
Instead of building malware themselves, customers simply rent attack power.
How Dysphoria Infects Devices
Old and New Vulnerabilities Together
The malware spreads using multiple infection techniques.
These include:
Weak Telnet passwords
Weak SSH credentials
Internet-exposed IoT devices
Known router vulnerabilities
Security cameras
Embedded Linux systems
Researchers observed exploitation of both recent vulnerabilities such as CVE-2025-55182 and much older flaws like CVE-2017-17215, which still affects many unpatched Huawei devices.
This serves as another reminder that outdated firmware remains one of the greatest risks across global IoT deployments.
Unexpected Humor Inside Malware
An Unusual FTP Banner
Despite the sophisticated engineering behind Dysphoria, researchers found an unusual message on one download server.
Its FTP banner humorously reads:
“220 cool ftp server hosted on brian krebs’ giant ass 4head.”
Although clearly intended as a joke aimed at cybersecurity journalist Brian Krebs, it reflects the culture within certain cybercriminal communities, where humor and taunts are often mixed with highly organized criminal operations.
Global Victims Across Multiple Industries
No Sector Is Safe
Researchers observed attacks targeting organizations worldwide.
Industries include:
Internet service providers
Gaming companies
Online platforms
Digital infrastructure
Cloud services
Various enterprise sectors
Attack activity occurs almost every day, suggesting the operators maintain a constant stream of customers purchasing DDoS capabilities.
Deep Analysis
Technical Investigation and Defensive Commands
Security professionals investigating Dysphoria or similar botnets can use the following commands during incident response and threat hunting.
Check active network connections
netstat -antp ss -tunap
Monitor suspicious outbound traffic
tcpdump -i any
Search for unexpected listening services
lsof -i
Detect UPnP exposure
upnpc -l
Scan for Telnet services
nmap -p 23 <target-ip>
Scan for SSH exposure
nmap -p 22 <target-ip>
Identify vulnerable IoT devices
nmap -sV --script vuln <network>
Inspect firewall rules
iptables -L
Review scheduled persistence
crontab -l systemctl list-unit-files
Monitor unusual processes
ps aux top htop
Analyze DNS lookups
tcpdump port 53
Review authentication attempts
journalctl -u ssh cat /var/log/auth.log
Verify router firmware versions
show version
Update packages
apt update && apt upgrade
Block suspicious IP ranges
iptables -A INPUT -s <ip-address> -j DROP
These commands assist defenders in identifying compromised IoT systems, monitoring suspicious network behavior, and reducing the attack surface that botnets like Dysphoria commonly exploit.
What Undercode Say
The Real Innovation Is Not the Botnet Size
Many malware campaigns have controlled hundreds of thousands of devices before. What makes Dysphoria exceptional is not the number of infected hosts but the intelligence behind its infrastructure. Instead of relying on centralized servers that defenders can blacklist, the operators have embraced decentralized blockchain naming systems, making their command infrastructure significantly harder to disrupt.
Blockchain Abuse Will Become More Common
ENS and SNS were created for legitimate decentralized applications, yet this incident illustrates how emerging technologies often attract malicious experimentation. Similar abuse could eventually extend to decentralized storage, distributed identity platforms, and peer-to-peer communication protocols.
Stealth Has Become More Valuable Than Firepower
The relay-node architecture demonstrates that attackers increasingly value persistence over raw attack volume. By hiding command servers behind compromised devices, they complicate attribution and make incident response slower and more resource-intensive.
IoT Security Remains the Weakest Link
The continued exploitation of vulnerabilities from nearly a decade ago is alarming. Organizations often replace servers and desktops on predictable cycles, but routers, DVRs, and cameras remain online for years without firmware updates. These forgotten systems become permanent entry points for botnets.
Encryption Is No Longer Just About Privacy
The customized RC4 implementation illustrates how malware authors are investing heavily in anti-analysis features. Modern malware developers understand reverse engineering techniques and deliberately build obstacles to slow researchers, extending the lifespan of their campaigns.
Cybercrime Is Becoming an Industry
Subscription pricing, customer support, scalable infrastructure, and automated health monitoring resemble commercial cloud providers. The distinction between organized cybercrime and legitimate software businesses continues to blur, differing primarily in purpose rather than operational sophistication.
Relay Networks Complicate Attribution
Traditional investigations often focus on tracing connections back to a command server. Dysphoria intentionally breaks that investigative path, forcing analysts to navigate layers of compromised relay nodes before identifying the true infrastructure.
Security Teams Must Shift Toward Behavioral Detection
Indicators of compromise such as IP addresses and domains become less useful when infrastructure changes dynamically through blockchain resolution. Behavioral analytics, anomaly detection, and endpoint monitoring will become increasingly important.
Legacy Vulnerabilities Continue to Fuel Modern Threats
One of the most striking aspects of Dysphoria is its reliance on both newly disclosed vulnerabilities and flaws dating back many years. This reinforces a long-standing cybersecurity reality: attackers rarely need unknown exploits when so many known vulnerabilities remain unpatched.
The Future of Botnets Will Be Decentralized
Dysphoria offers a preview of what future malware ecosystems may resemble. Distributed infrastructure, encrypted communications, decentralized naming services, and autonomous relay networks are likely to become defining characteristics of next-generation botnets, making traditional disruption strategies increasingly ineffective.
Prediction
(-1) Decentralized Malware Will Challenge Traditional Defenses
If current trends continue, future botnets will increasingly abandon centralized infrastructure in favor of blockchain-based services, peer-to-peer networking, and distributed relay architectures. This evolution will make takedowns more difficult, reduce the effectiveness of conventional threat intelligence, and force defenders to rely more heavily on behavioral detection, AI-assisted threat hunting, and continuous IoT security management. Organizations that continue to overlook firmware updates and exposed embedded devices may become the primary fuel for the next generation of global botnet campaigns.
✅ Confirmed: QiAnXin XLab and
✅ Confirmed: The malware employs customized encryption, blockchain-based C2 resolution, relay-node functionality, and targets IoT devices through weak Telnet/SSH credentials and known vulnerabilities, representing a significant technical evolution over earlier variants.
❌ Not Independently Verified: The
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
