Cybersecurity researchers at XLAB have tracked a fast-growing botnet family called Dysphoria since the first quarter of 2026. The botnet reportedly controls more than 200,000 compromised devices.
It has rapidly evolved from conventional DDoS malware into a distributed command-and-control (C2) proxy network.
The group’s latest development is especially concerning, a dedicated relay variant can turn infected routers, gateways, cameras, and embedded Linux devices into externally reachable proxy nodes.
By abusing UPnP, the malware maps 155 ports on a victim’s router and transparently forwards traffic to attacker-controlled infrastructure.
This makes the botnet harder to disrupt because its C2 layer is spread across compromised residential and IoT devices rather than limited to a small number of servers.
Dysphoria has evolved through several variants, including jackskid and fbot-derived samples.
Early activity observed in late March used the Ethereum Name Service (ENS) domain m3rnbvs5d.eth, while later versions adopted ENS and Solana Name Service (SNS) domains to locate C2 infrastructure.
Dysphoria Exploits 155 Router Ports
Observed domains include ukranianhorseriding.eth, burrberry.eth, and 24carnforth2merseyside.sol. Instead of relying only on traditional DNS records, the malware queries blockchain-based naming services for TXT or custom records.
This approach offers attackers more resilient infrastructure discovery because blockchain records can be more difficult for defenders to remove or seize.
{
"status": "ONLINE",
"connections": 42,
"bandwidth_mbps": 12.5
}The latest DDoS-capable samples use encrypted strings and a modified RC4-like routine. The implementation combines standard RC4 operations with a linear congruential generator and a linear feedback shift register, making static configuration extraction more difficult for analysts.
Dysphoria also hides C2 addresses inside fake IPv6-looking values. The malware extracts selected bytes and applies a custom decoding function to reconstruct the actual IPv4 address.
It then contacts relay-distribution servers over HTTP, requesting a live list of proxy nodes. Those nodes are compromised devices configured to forward C2 traffic.
This architecture separates the botnet’s attack clients from the final C2 servers. If a relay is blocked or taken offline, operators can provide infected bots with new relay addresses without rebuilding the entire infrastructure.
A standalone Dysphoria relay variant appeared in late June. Unlike earlier samples, this version does not include DDoS attack functions. Its only purpose is to create a proxy layer from compromised systems.
After execution, the relay searches for UPnP-enabled gateways on the local network. It attempts to create port mappings for 155 ports, allowing inbound connections to reach the infected device even when it sits behind NAT.
The malware listens on these ports and uses Linux epoll-based non-blocking I/O to relay traffic between an external connection and a remote C2 service using the same port number, qianxin said.
The relay periodically sends health reports to login.trees4sale.net:9000. These reports can include node availability, connection totals, and bandwidth information, allowing operators to identify active proxy systems.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
