Chinese security researchers have uncovered a sprawling IoT botnet called Dysphoria that has infected more than 200,000 devices worldwide, relying on Ethereum and Solana blockchain name services to keep its command infrastructure alive when conventional takedowns would cut off ordinary botnets.
The botnet first appeared in March 2026, and X Lab, the research arm of Chinese security firm QAX, has tracked its evolution alongside the National Computer Network Emergency Response Technical Team of China (CNCERT). What started as a single malware family has split into two distinct strains: one focused on DDoS attacks and a second that turns infected devices into relay proxies for other criminals.
This matters because IoT botnets have become one of the most persistent threats on the internet over the past decade. The Mirai botnet that surfaced in 2016 demonstrated how thousands of poorly secured cameras and routers could generate attacks exceeding 1 Tbps. Since then, each new family has added refinements — better encryption, more resilient C2 infrastructure, and now blockchain-based command channels that no single company or government can shut down unilaterally. Dysphoria represents the next step in that evolution, merging proven code from earlier malware lineages with a takedown-resistant control layer that exploits the decentralized nature of Ethereum and Solana.
Blockchain domains replace traditional C2 servers
Most botnets use hardcoded IP addresses or domain names for command-and-control, giving defenders a fixed target they can seize or sinkhole. Dysphoria queries Ethereum Name Service (ENS) and Solana Name Service (SNS) domains instead, pulling C2 infrastructure details from DNS TXT records that sit outside the conventional domain registration system.
The ENS domain burrberry.eth returns relay distribution node addresses through a record labelled "node." A separate ENS domain, ukranianhorseriding.eth, supplies base network infrastructure through a "network" key. The Solana domain 24carnforth2merseyside.sol, added in early May, performs the same function through a "deserialised" record.
Blockchain name registries sit outside conventional takedown processes. A defender trying to disrupt this infrastructure has no registrar or hosting provider to serve notice to in the way a standard domain seizure would allow.
The records don't contain plain IP addresses either. X Lab found the TXT data formatted to resemble IPv6 addresses, with the actual C2 target embedded across specific byte segments and disguised using bit rotation and XOR operations against a fixed key. A sample string decoded during the investigation — 12e7:13d7 — resolves to the IPv4 address 144.31.38.215 once processed. Anyone scanning the record casually sees what looks like a dead IPv6 entry rather than an active command endpoint.
From single malware strain to dual-purpose network
A jackskid-based sample captured on March 25 linked to a Telegram channel through an ENS domain. By April 1, the fbot variant had replaced it. Late April brought a new RC4-based string encryption scheme alongside the blockchain C2 lookup mechanism, and early May added the Solana domain and its TXT-record distribution method.
June marked the point where the family split in function. On June 25, X Lab captured a sample stripped of DDoS attack code entirely, operating solely as a relay and proxy node. Two days later, the family added UPnP-based automated port mapping and combined DDoS-capable samples with a regularly updated list of relay nodes, completing what the report calls a hybrid C2 structure.
The DDoS-capable variant now uses a custom RC4 decryption routine to protect embedded strings, layering a Linear Congruent Generator into the key-scheduling phase and a Linear Feedback Shift Register into stream generation. Login and heartbeat packets are both fixed at 78 bytes, distinguished by separate 12-byte magic values. Attack commands carry a nested structure specifying duration, attack type, target IP ranges with netmasks, and a variable set of flags for parameter control.
Relay variant turns home routers into proxy infrastructure
The relay-only variant that appeared in late June has one job: convert an infected device sitting behind home or office NAT into a usable proxy point for other operators. Most IoT devices and PCs sit behind NAT and can't accept inbound connections directly, so the sample broadcasts on the local network looking for gateways that support UPnP, then calls the WAN connection service to open a port on the router automatically. X Lab's report notes samples opening port 155 specifically during this process.
Once that port is live, the compromised device uses Linux's epoll asynchronous I/O to bind an inbound connection from an attacker to an outbound connection toward the real target, moving traffic in both directions without buffering the full stream. The relay node then reports its status — active connection count and bandwidth usage — to a heartbeat collection domain roughly every four seconds in JSON format. A device owner has no obvious sign anything is wrong beyond unexplained bandwidth consumption.
Propagation and scale
Dysphoria spreads mainly through Telnet and SSH weak-password brute-forcing, combined with known remote code execution vulnerabilities in routers, gateways, and cameras. The exploit list spans older IoT flaws that botnets have used for years — CVE-2017-17215 and CVE-2020-8515 — alongside more recent disclosures such as CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, and CVE-2025-55182. This mix indicates ongoing maintenance of the propagation code rather than a static exploit chain.
X Lab's monitoring recorded 4,401 confirmed active bots inside China between July 14 and July 20, 2026, with a daily peak of 1,801 online and 740,000 C2 sessions on the busiest day. Overseas infections ran much larger, with a peak of 239,000 bots online in a single day — a gap the report attributes to the relay conversion mechanism inflating the apparent footprint of controlled infrastructure.
Commercial DDoS rental model
Leaked screenshots of the Dysphoria control panel circulating on social media show a consistent bot count near 200,000 that X Lab says lines up with its own monitoring figures. The report notes Dysphoria's operators advertise DDoS packages on a public page offering up to roughly 4 Tbps of attack capacity, priced from tens to hundreds of dollars depending on duration and bandwidth tier.
Targets recorded during the monitoring period span internet services and gaming companies across multiple countries, with attack activity logged on close to a daily basis.
What defenders can do
For security teams running exposed IoT or network edge equipment, the practical response starts with the same basics that predate Dysphoria: disable Telnet where it isn't needed, rotate default SSH credentials, and patch the specific CVEs X Lab identified rather than assuming firmware updates happen automatically.
Monitoring outbound UPnP port-mapping requests and unexpected connections to port 9000 on unfamiliar IP ranges would also help catch the relay behavior before a device becomes someone else's proxy infrastructure.
Enterprise security teams should also look at DNS traffic to blockchain name service domains — queries to ENS or SNS resolvers from devices that have no business asking for blockchain records are a strong indicator of compromise. X Lab's report provides Snort and Suricata rules that detect the characteristic 78-byte heartbeat packets and the UPnP SOAP requests that Dysphoria uses to open router ports.
The broader lesson is that IoT security remains a race between manufacturers who ship devices with minimal hardening and attackers who continuously evolve their methods. Regulatory pressure is building — the EU Cyber Resilience Act, which took full effect in 2025, requires manufacturers to provide security support for the expected lifetime of connected products and to report actively exploited vulnerabilities within 24 hours. Dysphoria's reliance on older CVEs and weak-password brute-forcing suggests that many of the 200,000 infected devices are either unpatched or still running factory-default credentials, which legislation alone cannot fix without enforcement.
The IoT Tech Expo Europe taking place in Amsterdam later this year will cover industrial IoT security and edge intelligence topics that address precisely these kinds of threats.
X Lab's full report with indicators of compromise is available on the QAX threat research portal.
For more IoT security coverage, visit our Cybersecurity and IoT sections for the latest on connected-device threats and defensive strategies.