Dysphoria: The Blockchain-Hidden Botnet That Emerged Days After a Major Takedown

Most botnets can be killed by seizing a server or blocking a domain. Dysphoria’s operators built around that weakness — hiding their commands inside Ethereum and Solana blockchain records instead. It emerged days after a major international takedown wiped out its own ancestor. Here’s how it actually works.

A Botnet Born From a Takedown

On March 19, 2026, the US Department of Justice announced it had disrupted four major IoT botnets — Aisuru, Kimwolf, JackSkid, and Mossad — in coordinated action with authorities in Canada and Germany. According to the DOJ, the four botnets had collectively infected more than three million devices worldwide and had been used to launch some of the largest DDoS attacks ever recorded, with peaks around 30 terabits per second. Court documents attributed more than 90,000 individual DDoS attack commands to JackSkid alone, which had averaged over 150,000 daily victims in just the first two weeks of that March, according to data from Lumen’s Black Lotus Labs.

Six days later, on March 25, researchers at QiAnXin XLab captured their first sample of what would become Dysphoria — built directly on JackSkid’s code. What followed was one of the fastest botnet evolution cycles researchers say they’ve tracked: from a straightforward IoT infector in March to a blockchain-cloaked, dual-purpose DDoS-and-relay network by late June, iterating meaningfully roughly every few weeks rather than the months or years typical of most malware families.

Coverage of the March 2026 takedown of Aisuru, Kimwolf, JackSkid, and Mossad — the operation whose aftermath produced Dysphoria. Independent production, not affiliated with Wangdoo.

Why Hiding Commands in a Blockchain Actually Works

Most botnets have a structural weak point: somewhere, a server or domain has to tell infected devices what to do next. Find that address, and defenders can seize it, sinkhole it, or get a registrar to pull it — which is exactly how the March takedown disrupted Aisuru, Kimwolf, JackSkid, and Mossad in the first place.

Dysphoria’s operators built around that specific failure mode. Rather than a conventional domain, infected devices query Ethereum Name Service (ENS) and Solana Name Service (SNS) records — essentially, blockchain-based naming systems, best known for letting crypto wallets use human-readable names instead of long addresses. XLab identified the specific domains in active use, including burrberry.eth and ukranianhorseriding.eth on Ethereum, and 24carnforth2merseyside.sol on Solana. The malware pulls infrastructure data out of these records’ TXT fields rather than standard DNS.

Hiding a Real IP Inside a Fake One

The obfuscation goes a layer deeper than just using blockchain records. According to XLab’s technical analysis, once the malware resolves a blockchain domain, the data returned isn’t a plain IP address — it’s text containing what looks like a fake IPv6 address, formatted convincingly enough to blend in. The malware extracts four specific bytes from that fake address and runs them through a custom transformation function to recover the actual command server’s real IPv4 address.

XLab’s published proof-of-concept shows the mechanism clearly: a fragment of the fake IPv6 string decodes, byte by byte, into an ordinary dotted IPv4 address using a fixed transformation key. It’s a deliberately obscure detail buried in plain sight — the kind of address that would look like meaningless boilerplate to anyone skimming raw network traffic, rather than an active command server location.

The Malware Wears a Disguise Too

Beyond hiding its infrastructure, Dysphoria hides itself on the infected device. Both the DDoS and relay variants alter their process name at runtime to masquerade as libdalvikengine.so — a name designed to look like a routine Android system library rather than malware, to anyone glancing at a process list on an infected device.

The string encryption protecting the malware’s internal data is similarly deliberate. XLab’s analysis found a customised RC4 encryption routine layered with an additional linear congruential generator during key setup and a linear feedback shift register during output generation — extra mathematical steps specifically added to make automated string-decryption tools, commonly used by malware analysts, fail against it.

From DDoS Weapon to Silent Relay Network

The most significant shift in Dysphoria’s evolution happened on June 25, when XLab captured a variant that had stripped out DDoS functionality entirely. This version has exactly one job: convert the infected device into an anonymous relay node for the botnet’s broader infrastructure.

It does this by abusing UPnP — Universal Plug and Play, a router feature designed to let devices on a home network automatically open the ports they need. The relay variant scans the local network for a UPnP-capable router and forces open 155 separate port-forwarding rules in one pass, exposing the infected device to inbound internet traffic it was never meant to receive. Once configured, the device uses Linux’s high-performance epoll mechanism to silently pass traffic back and forth between an external connection and the botnet’s real infrastructure — becoming, in effect, an anonymising layer standing between investigators and whoever is actually operating the botnet.

Every four seconds or so, relay nodes phone home to a heartbeat domain — login.trees4sale.net — reporting their status, connection count, and available bandwidth in a small JSON message, letting operators monitor their distributed proxy network in something close to real time.

Who’s Actually Getting Infected

Dysphoria spreads the way most IoT botnets do: brute-forcing weak Telnet and SSH credentials, and exploiting known vulnerabilities in routers, cameras, and other embedded Linux devices. XLab’s published exploit list spans both old and new flaws — long-known router vulnerabilities like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek) sit alongside far more recent disclosures, including a Linksys command-injection bug (CVE-2025-9528) publicly documented with working exploit code as recently as August 2025.

That mix matters. It shows Dysphoria’s operators are actively maintaining the malware’s infection code rather than relying on a single static exploit — while weak, reused, or default credentials remain the simpler and more consistent way in for most infected devices. XLab’s monitoring between July 14 and 20 recorded a peak of 740,000 daily check-ins from infected hosts, with roughly 239,000 devices online outside China on the busiest day and 1,800 inside China — a gap XLab attributes partly to how the relay-conversion mechanism can inflate the apparent size of controlled infrastructure beyond the botnet’s core device count.

What You Can Actually Do

My Take — Mr Wangdoo

The detail in this research I find most telling isn’t the blockchain angle, even though that’s the headline-grabbing part. It’s the six-day gap between the DOJ’s takedown announcement and XLab’s first Dysphoria sample. That’s not a coincidence, and it’s not really a comeback story either — it’s evidence that removing infrastructure doesn’t remove the underlying capability. JackSkid’s code didn’t disappear when its servers were seized. It got picked up, modified, and pointed at a communication channel specifically chosen to resist exactly the kind of takedown that had just worked against its predecessor.

That’s the part worth sitting with if you’re thinking about botnet takedowns as a durable solution rather than a temporary disruption. Seizing servers and domains works precisely because most malware still depends on infrastructure a court or registrar can reach. Blockchain-based command resolution is a direct, deliberate response to that dependency — not because the underlying blockchain technology is inherently criminal, but because it happens to offer exactly the kind of decentralised, hard-to-compel record system that malware operators want and that traditional takedown tools were never built to touch.

I’d also flag the relay-conversion shift as the more operationally significant change, even though it’s less flashy than the blockchain angle. A pure DDoS botnet is a weapon — disruptive, but a known quantity defenders can measure and mitigate. A botnet that quietly turns hundreds of thousands of home routers into an anonymising relay mesh is closer to infrastructure-as-a-service for anyone willing to pay — DDoS, sure, but also potentially anything else that benefits from routing traffic through an anonymous residential IP address. That’s a more durable business model than DDoS-for-hire alone, and it’s the kind of shift worth watching for in whatever comes after Dysphoria eventually gets disrupted too.

Frequently Asked Questions

Clayton Samuel (Mr Wangdoo), QFA

Founder and editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure. This article is based on the original security researchers’ disclosure and independent technical reporting. No interviews were conducted; no product is promoted.