A rapidly evolving botnet called Dysphoria has infected roughly 200,000 devices worldwide and adopted blockchain-based domain names to hide its command-and-control infrastructure, making it substantially harder for defenders to disrupt. Researchers at QiAnXin XLab, jointly with China’s national computer emergency response team CNCERT, disclosed the threat in late July 2026 after tracking its aggressive technical evolution since March.
Dysphoria’s use of Ethereum and Solana blockchain domains to store command infrastructure represents a meaningful escalation in how malware operators can evade traditional takedown methods. Instead of relying on hardcoded IP addresses or conventional domain names that registrars or hosting providers can seize, the botnet queries blockchain-based name services to retrieve command details from decentralized records.
The botnet descended from earlier malware families known as jackskid and fbot. Dysphoria emerged within days of a coordinated U.S., German, and Canadian law-enforcement operation that disrupted JackSkid infrastructure on March 19. Within six days, researchers captured a Dysphoria sample linked to the Ethereum Name Service domain m3rnbvs5d.eth, signaling that operators had already shifted to blockchain-based command resolution.
The botnet queries ENS domains like burrberry.eth and ukranianhorseriding.eth, as well as the Solana domain 24carnforth2merseyside.sol, to pull command infrastructure details from TXT records. The actual command server addresses are not stored as plain IP addresses. Instead, they appear as fake IPv6 strings, and the genuine targets are extracted using a custom byte-transformation function.
A sample string decoded during analysis, 12e7:13d7, resolves to the IPv4 address 144.31.38.215 once processed through the decryption routine. Anyone scanning the blockchain record casually sees what resembles a dead IPv6 entry rather than an active command endpoint. This obfuscation technique keeps attacker server addresses hidden from basic network inspection.
Blockchain name registries exist outside conventional takedown processes. A defender attempting to disrupt this infrastructure has no registrar or hosting provider to serve notice on, unlike a standard domain seizure. The distributed nature of blockchain records means there is no single authority that can revoke or redirect the entries.
Since first appearing in March 2026, Dysphoria has undergone frequent mutations across just four months. On March 25, the initial jackskid variant tied to m3rnbvs5d.eth exposed a debug string reading “android has no compatible libc library.” On April 1, researchers observed an fbot variant that printed “hail china mainland” at runtime, signaling a related but distinct strain within the same ecosystem.
Late April brought a custom RC4-based string encryption scheme alongside blockchain C2 acquisition logic. The modified RC4 algorithm adds two extra phases beyond standard RC4 initialization. A Linear Congruential Generator shuffles the S-box five times, and a Linear Feedback Shift Register steps during keystream generation, performing complex bit shifts before the final byte is applied.
This layered encryption means all strings in the malware are protected and cannot be recovered through basic reverse-engineering scans. The heavily modified cipher makes static signature-based detection substantially more difficult. Early May brought Solana-based SNS infrastructure with 24carnforth2merseyside.sol distributing assets via TXT records, followed by activation of burrberry.eth on June 10.
The most significant architectural shift occurred on June 25, when researchers captured a Dysphoria variant stripped of all DDoS attack modules. This relay-only sample operated purely as a proxy node, converting the infected device into a hidden traffic relay. Two days later, the botnet added automated UPnP port mapping, which allows the malware to traverse network gateways without manual configuration.
The hybrid model now combines DDoS-capable samples with a dynamic list of compromised relay nodes. Infected devices relay traffic to the actual command servers, keeping real infrastructure one step removed from direct exposure. This design substantially complicates traditional server seizure because defenders cannot shut down command infrastructure simply by seizing a single endpoint.
The relay variant uses UPnP to map ports on the infected device’s local gateway and Linux epoll to shuttle traffic between outside connections and remote C2 services. The transformation demonstrates that Dysphoria’s operators have invested heavily in making the botnet resilient to both law-enforcement action and industry takedowns.
The telemetry published by XLab and CNCERT logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad. Neither count has been independently reproduced, and the researchers published no counting or de-duplication methodology. The numbers should be read as estimates rather than a precise device census.
Defenders should prioritize patching exposed IoT gear, replacing devices that can no longer be updated, and eliminating default or weak credentials. Disabling remote management and UPnP where they are not needed significantly reduces exposure to infection. The threat affects routers, cameras, gateways, and other embedded Linux systems that remain online with insufficient security controls.
The adoption of blockchain-based command infrastructure represents a meaningful defensive evasion technique that sits at the intersection of cryptocurrency technology and traditional malware operations. The design does not remove infrastructure from the chain entirely, as the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays. However, it does eliminate the single point of failure that conventional domain seizures provided.
Japan’s NICT independently documented the same shift from JackSkid to ENS and SNS infrastructure in May 2026, confirming that multiple research teams observed the same technical pattern. The convergence on blockchain-based command resolution suggests this approach may become more common as operators seek ways to maintain resilience against law-enforcement disruption and industry takedowns.
