Full Report
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese
Analysis Summary
# Tool/Technique: Dysphoria IoT Botnet
## Overview
Dysphoria is an evolved IoT botnet lineage tracked by CNCERT and XLab. It emerged as a successor to the disrupted **JackSkid** infrastructure following law enforcement actions in March 2026. The botnet is primarily designed for large-scale Distributed Denial of Service (DDoS) attacks and is notable for its use of blockchain-based decentralized infrastructure to evade traditional server seizures.
## Technical Details
- **Type:** Malware Family (IoT Botnet)
- **Platform:** Linux-based IoT devices (Routers, Gateways, Cameras)
- **Capabilities:** DDoS, Blockchain-based C2 resolution, Traffic Relaying, NAT Traversal.
- **First Seen:** March 2026 (following the JackSkid disruption)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- [T1110.001 - Brute Force: Password Guessing]
- **[TA0011 - Command and Control]**
- [T1568.003 - Dynamic Resolution: DNS Name Service] (via ENS/SNS)
- [T1090.002 - Proxy: External Proxy] (Infected-device relays)
- [T1571 - Non-Standard Port]
- **[TA0040 - Impact]**
- [T1498 - Network Denial of Service]
## Functionality
### Core Capabilities
- **Decentralized C2 Resolution:** Uses Ethereum Name Service (ENS) and Solana Name Service (SNS) to resolve distribution node IP addresses, making it difficult for authorities to "take down" a central domain.
- **Vulnerability Exploitation:** Spreads via known RCE flaws such as CVE-2025-9528 (Linksys E1700 command injection).
- **Credential Brute Forcing:** Targets weak Telnet and SSH credentials to gain initial access to IoT hardware.
- **DDoS Engine:** Capable of launching large-scale volumetric attacks, with operator claims reaching up to 4 Tbps.
### Advanced Features
- **Relay Mesh Architecture:** Implements a multi-tier C2 structure where infected devices act as relays, masking the true location of the command-and-control servers.
- **NAT Traversal:** Utilizes UPnP-based port mapping to allow the botnet to communicate through NAT gateways and firewalls.
- **Evasive Communication:** Features custom RC4 string encryption to hinder static analysis and signature-based detection.
- **Relay-Only Variant:** A specialized build that drops DDoS modules to focus exclusively on shuttling traffic using Linux `epoll`, optimizing the device for infrastructure support rather than attack execution.
## Indicators of Compromise
- **File Names:** JackSkid (legacy), various IoT-oriented binary names.
- **Network Indicators:**
- `m3rnbvs5d[.]eth` (ENS Domain)
- `burrberry[.]eth` (ENS Domain - Distribution nodes)
- `24carnforth2merseyside[.]sol` (SNS Domain - Infrastructure records)
- **Behavioral Indicators:**
- High volume of outbound Telnet/SSH traffic (scanning).
- Port mapping requests via UPnP to local gateways.
- Unusual DNS queries to blockchain-related resolution gateways.
## Associated Threat Actors
- No specific named group; however, it is heavily linked to the **JackSkid** botnet operators and shares code with the **Kimwolf** botnet family.
## Detection Methods
- **Signature-based:** Detect custom RC4 encryption routines in IoT binaries.
- **Behavioral:** Monitor for rapid, automated Telnet/SSH login attempts (brute force) from IoT devices.
- **Network Monitoring:** Alert on DNS requests for `.eth` or `.sol` domains and unexplained UPnP port mapping activity.
## Mitigation Strategies
- **Patch Management:** Apply updates to all exposed IoT gear, specifically addressing RCE vulnerabilities like CVE-2025-9528.
- **Credential Hardening:** Enforce strong, unique passwords for Telnet and SSH; disable these services if not required.
- **Network Edge Hardening:** Disable UPnP and remote management interfaces on routers and gateways.
- **Device Lifecycle:** Decommission and replace end-of-life (EoL) IoT devices that no longer receive security patches.
## Related Tools/Techniques
- **JackSkid:** The predecessor botnet.
- **Kimwolf:** A related botnet utilizing ENS-based C2 resolution.
- **Mirai:** Shares the general IoT-targeting and DDoS-focused philosophy common to this lineage.