A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations.

According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the ‘jackskid’ and ‘fbot' malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism.

Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.

The researchers first spotted Dysphoria on March 25 and identified multiple iterations that added meaningful updates, such as a C2 acquisition algorithm, multi-chain support, new domains, and functional separation between the relaying and DDoS variants.

“Since the first quarter of 2026, XLAB has continuously tracked an emerging botnet family named Dysphoria, whose bot count exceeds 200,000,” reads XLab's report.

“In just a few months, the family has undergone frequent variant updates and technical iterations, demonstrating extremely strong resilience.”

The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle.

Based on the researchers' analysis, infected clients send a fixed 78-byte login and heartbeat packet back to the C2 and receive from the operator DDoS attack commands that include duration, type, targets, and configurable flags.

In late June, XLab observed a variant that focused only on transforming infected devices into network proxies, and completely discarded the DDoS functionality.

The malware abuses UPnP (Universal Plug and Play) on the compromised device to create 155 port forwarding rules to expose internal services to inbound internet connections.

XLab's report notes that the botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and various IoT devices.

Among the more recent flaws exploited are CVE-2025-55182 (“React2Shell”), CVE-2025-34152, CVE-2025-28137 (Totolink), and CVE-2025-9528 (Linksys). However, Dysphoria also targets older weaknesses that still persist in many devices, like CVE-2017-17215 (Huawei) and CVE-2020-8515 (DrayTek).

XLab monitored the botnet between July 14 and 20 and recorded a peak of 740,000 daily pings from infected hosts, 239,000 connections from overseas clients, and 1,800 from China.

The researchers confidently estimate that the number of infected devices is around 200,000 at this time.

Concerning the botnet’s firepower, its operators claim a maximum DDoS capacity of 4 Tbps on their clearnet site, which promotes the service as a legitimate stress-tester.

Despite being significantly lower than the current record figure of 31.4 Tbps achieved by the Aisuru/Kimwolf botnet in December 2025, it is still enough to cause notable disruptions.

Users can protect against botnet infections by keeping their devices’ firmware up to date, changing the default administrator password, disabling remote access if not necessary, and strengthening the security settings where available/possible.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper