Dysphoria IoT Botnet Uses Blockchain for C2 After JackSkid Disruption

Dysphoria Botnet Emerges with Blockchain C2

The Dysphoria Internet of Things (IoT) botnet has integrated blockchain-based name services and infected-device relays for its command-and-control (C2) infrastructure. This development follows a law enforcement operation in March that targeted JackSkid, a predecessor botnet.

Researchers from CNCERT, China's national computer emergency response team, and Qi'anxin's XLab, a threat-intelligence lab, have been tracking Dysphoria. They report that the botnet's design makes it more difficult to disrupt.

Estimated Scale and Activities

CNCERT and XLab estimate the Dysphoria botnet to comprise over 200,000 bots globally. Telemetry from July 14 to 20 recorded 4,401 active devices within China, with a single-day peak of 239,000 bots observed outside China. These numbers have not been independently verified, and the researchers did not publish their counting or de-duplication methodology.

The compromised devices are being utilized for distributed denial of service (DDoS) attacks and traffic relay operations.

Evolution from JackSkid

Dysphoria evolved from the 'jackskid' and 'fbot' malware. The lineage includes JackSkid, which was one of four IoT botnets targeted in coordinated law enforcement actions by the U.S., Germany, and Canada on March 19. Court documents attributed over 90,000 DDoS commands to JackSkid alone.

XLab researchers first identified Dysphoria on March 25 and have noted multiple updates, including a C2 acquisition algorithm, multi-chain support, new domains, and functional separation between relaying and DDoS variants.

Blockchain for Resilience

The botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information. C2 addresses are hidden within fake IPv6 strings and recovered using a custom byte-transformation algorithm. This use of blockchain in C2 operations makes the botnet's infrastructure more challenging to trace and dismantle, enhancing its resilience against disruption.

The frequent variant updates and technical iterations observed in Dysphoria demonstrate its strong resilience, according to XLab's report.

Mitigation Recommendations

To mitigate risks from such botnets, defenders are advised to patch exposed IoT devices, replace devices that no longer receive updates, eliminate default and weak credentials, and disable remote management and UPnP when not essential.