Dysphoria: A 200k-Device Botnet Using Blockchain Name Resolution and Infected Device Relays
Dysphoria: A 200k-Device Botnet Using Blockchain Name Resolution and Infected Device Relays 1. Basic Information Article Title : New Dysphoria DDoS botnet spreads to 200k devices worldwide Publisher : BleepingComputer Publication Date : 2026-07-27 Original Source : https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/ Primary Source : https://blog.xlab.qianxin.com/dysphoria/ Related Entities : Dysphoria, jackskid, fbot, ENS, SNS, UPnP, Telnet, SSH, IoT/embedded Linux Related CVEs : CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, and others Severity : High Main IOCs : burrberry.eth , ukranianhorseriding.eth , 24carnforth2merseyside.sol , login.trees4sale.net , c2.saintpetersburgresident.ru 2. Summary This is a large-scale Linux botnet. It breaks into devices using weak Telnet/SSH passwords and various IoT RCE vulnerabilities. It gets multi-stage C2 servers from ENS/SNS records. It turns infected devices into relay nodes or DDoS bots by opening 155 ports using UPnP. 3. Attack Flow Infection and DDoS Chain Attackers compromise routers, gateways, and cameras using weak Telnet/SSH credentials or known RCE vulnerabilities. The malware runs a Linux binary. It hides its process name as libdalvikengine.so . It decrypts strings using modified RC4 (with added LCG/LFSR). It reads TXT and custom records from ENS/SNS, converts fake IPv6 formats, and gets distributor node IP addresses. It gets a list of infected device relays from http://<node>:9000/nodes?key=meowmeowmeow . It connects to the C2 server using a fixed 78-byte login and heartbeat. It executes DDoS commands that include duration, attack type, target, and flag. Relay-Only Chain A relay variant without DDoS features searches for UPnP-enabled gateways. It creates 155 port forwards on the WAN side and listens on its own device. It