Dysphoria Botnet Strengthens with Blockchain-Based Command System
Next-gen IoT botnet becomes more resilient with blockchain technology.
1The Rise of Dysphoria Botnet
After the JackSkid operation, the reorganized Dysphoria botnet established a more resilient infrastructure with blockchain-based C2 and victim device relays. Researchers detected over 200,000 infected devices.
2Decentralized Structure with Blockchain
Using Ethereum and Solana Name Services, the botnet bypasses traditional server takedown operations with its distributed architecture. It manages distribution nodes through ENS and SNS records.
3New NAT-Traversing Variant
The relay-only variant that emerged in late June targets devices behind NAT with UPnP-based port mapping. It features traffic routing instead of DDoS modules.
4Exploiting Vulnerabilities
The botnet exploits weak Telnet/SSH credentials and IoT vulnerabilities like CVE-2025-9528 in Linksys E1700, targeting routers, gateways, and cameras. Manufacturers' failure to release security updates increases the risk.
5Global Threat Scale
With 4,401 active devices in China and 239,000 peak bots internationally, the botnet conducts daily DDoS attacks. Cloudflare's measured 31.4 Tbps attack from a similar botnet shows the potential threat scale.
6Protection Measures
Experts recommend replacing unupdatable IoT devices, removing default credentials, and disabling unnecessary remote management features. Next-gen defense strategies are needed against blockchain-based botnets.