Since Q1 2026, researchers at XLab have been tracking an aggressively evolving IoT botnet family dubbed “Dysphoria,” whose bot population is estimated at over 200,000 infected devices worldwide.
In just a few months, Dysphoria has rolled through multiple variants and architectural changes, demonstrating an unusually strong ability to survive both law‑enforcement pressure and industry takedowns.
The family’s lineage spans jackskid and fbot-style variants. It has now added a hybrid command‑and‑control (C2) model built on blockchain ENS/SNS domains and compromised hosts acting as relay nodes.
The evolution timeline shows a clear shift from traditional, centrally hosted C2 to a resilient, hard‑to‑pin‑down mesh.
On March 25, analysts captured a jackskid variant tied to the ENS domain m3rnbvs5d.eth, with the sample exposing a distinctive debug string, “android has no compatible libc library.”
On April 1, they observed an fbot variant that printed “hail china mainland\x00” at runtime, signaling a related but distinct strain within the same ecosystem.
By late April, Dysphoria introduced an RC4‑based string encryption and new C2 acquisition logic, activating the ENS domain ukranianhorseriding.eth.
Early May brought Solana-based SNS infrastructure with 24carnforth2merseyside.sol distributing assets via TXT records, followed by the activation of burrberry.eth on June 10.
Dysphoria Botnet Resilience
The turning point came on June 25, when researchers captured a variant stripped of DDoS capabilities, operating purely as a relay/proxy node.
Two days later, Dysphoria added automated UPnP port mapping and built a hybrid chain of “DDoS samples + dynamic C2 relay lists,” cementing its transformation into a relay-driven architecture that dramatically complicates takedowns.
At the code level, Dysphoria’s latest fbot variant invests heavily in string protection to frustrate reverse engineering and automated detection.
Its core decryption logic starts with a conventional RC4 Key Scheduling Algorithm (KSA). However, it then adds a second KSA phase driven by a Linear Congruential Generator (LCG) that shuffles the S‑box five times.
During the keystream generation (PRGA), it further integrates a Linear Feedback Shift Register (LFSR) plus multiple swap operations and bit shifts.
This layered obfuscation produces a non‑standard RC4‑like stream cipher that is much harder to analyze and statically sign.
On the infrastructure side, Dysphoria’s standout feature is its blockchain-based covert C2 resolution.
The botnet supports both Ethereum Name Service (ENS) and Solana Name Service (SNS) domains, querying custom records that encode relay and infrastructure data.
For example, burrberry.eth exposes a node record used to retrieve relay distribution IPs, while ukranianhorseriding.eth and 24carnforth2merseyside.sol carry network and deserialized keys for base network infrastructure, qianxin said.
Instead of hard‑coding IPv4 addresses, Dysphoria hides them inside spoofed IPv6 strings (e.g., segments like 12e7:13d7), extracts critical bytes, and runs them through a custom permutation function to reconstruct the real IPv4 address (e.g., 144.31.38.215).
This extra layer of encoding means defenders must understand both the blockchain records and the bespoke decoding logic to map Dysphoria’s actual C2 endpoints reliably.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
