A new IoT botnet called Dysphoria has grown to approximately 200,000 infected devices globally and embedded its command-and-control infrastructure in public blockchain naming services that cannot be seized through conventional law enforcement takedown operations. Research disclosed by XLab on July 27, 2026 identifies Dysphoria as a direct successor to the JackSkid botnet, which was dismantled by a coordinated U.S., German, and Canadian law enforcement operation in March 2026. The evolution from JackSkid to Dysphoria represents a deliberate architectural response to that takedown.
How Dysphoria Evolved From the JackSkid Takedown to Blockchain C2
The March 2026 operation against JackSkid disrupted the botnet’s infrastructure and took down over 90,000 previously issued DDoS commands attributed to the operation. Rather than rebuilding conventional domain-based command infrastructure susceptible to the same registrar coordination and DNS sinkholing that took down JackSkid, the operators pivoted to a fundamentally different model anchored in decentralized blockchain systems.
Dysphoria resolves its command-and-control addresses through two blockchain naming systems: the Ethereum Name Service domain m3rnbvs5d[.]eth and the Solana Name Service domain 24carnforth2merseyside[.]sol. These records exist on public, decentralized blockchains. Because no central registrar or authority controls them, they cannot be seized or taken offline through the conventional domain abuse processes that law enforcement agencies have historically used to dismantle botnet infrastructure. As long as the operators retain the private keys for those blockchain domains, the command channel remains operational regardless of any network-level or registrar-level interdiction.
A second resilience layer supplements the blockchain C2: infected devices function as relay nodes that conceal the actual IP address of the controller, preventing attribution of the true command server from network traffic observed at the device level.
Ethereum and Solana Name Services as Seizure-Proof Command Infrastructure
The Dysphoria C2 architecture shows a direct timeline response to the JackSkid takedown. The first ENS-based JackSkid sample appeared on March 25, 2026 — during the same month as the law enforcement operation. Solana Name Service resolution was added in May 2026, creating a redundant blockchain-backed command path across two independent blockchain networks. A relay-only variant of Dysphoria emerged in June 2026, demonstrating continued active development in the months following the predecessor’s disruption.
This evolution timeline shows the operator group absorbing the JackSkid takedown as operational intelligence, systematically hardening the replacement botnet against the specific interdiction methods that destroyed its predecessor, and adding redundancy to ensure no single blockchain network failure could sever the command channel.
CVE-2025-9528 and Telnet Brute-Force as Dysphoria’s Infection Vectors
Dysphoria infects new devices through two primary vectors. The first is CVE-2025-9528, a command injection vulnerability in the Linksys E1700 router. The second is brute-force attacks against devices running Telnet or SSH with weak or default credentials. Both vectors target the same category of device: consumer and small-business networking hardware that ships with insecure defaults and receives irregular or no firmware updates.
XLab’s monitoring window between July 14 and July 20 recorded 4,401 confirmed active devices in China alone. The single-day global peak reached 239,000 bots. Approximately 200,000 devices represent the botnet’s typical active scale globally, according to the research.
Dysphoria’s DDoS Operations and the Limits of Traditional Takedown Playbooks
Dysphoria conducts DDoS attacks against internet service providers and gaming companies “almost daily,” according to XLab’s analysis. The targeting pattern mirrors that of the JackSkid predecessor, indicating operational continuity at the campaign level alongside the architectural changes at the infrastructure level.
The broader implication of Dysphoria’s blockchain C2 model is that the law enforcement playbooks developed for botnet dismantlement over the past decade are insufficient against this architecture. Domain seizure, registrar coordination, and DNS sinkholing — the tools used against JackSkid and dozens of other botnets — have no purchase on records stored in Ethereum or Solana. New legal and technical frameworks for engaging with blockchain-resident infrastructure would be required to replicate the effects of traditional takedowns against botnets that have migrated to this model.
For defenders, the IoT-level remediation remains conventional: changing default Telnet and SSH credentials, applying firmware updates addressing CVE-2025-9528 on affected Linksys E1700 devices, and monitoring IoT network segments for anomalous outbound traffic bursts. Detection of Dysphoria infection at the device level does not require understanding its C2 architecture — the behavioral signals of a DDoS bot generating unexplained outbound connection volume are observable through standard network monitoring regardless of where those connections terminate.
