A rapidly evolving botnet called Dysphoria has infected roughly 200,000 devices worldwide and adopted blockchain-based domain names to conceal its command-and-control infrastructure, making it significantly harder for defenders to disrupt. Researchers at QiAnXin XLab, working jointly with China’s national computer emergency response team, CNCERT, disclosed the threat in late July 2026 after tracking its technical evolution since March.

Dysphoria’s use of Ethereum and Solana blockchain domains to store command infrastructure marks a notable escalation in how malware operators can evade traditional takedown methods. Rather than relying on hardcoded IP addresses or conventional domain names that registrars or hosting providers can seize, the botnet queries blockchain-based name services to retrieve command details from decentralized records.

The botnet descended from earlier malware families known as jackskid and fbot. Dysphoria appeared within days of a coordinated U.S., German, and Canadian law-enforcement operation that disrupted JackSkid infrastructure on March 19. Within six days, researchers captured a Dysphoria sample linked to the Ethereum Name Service domain m3rnbvs5d.eth, indicating that operators had already moved to blockchain-based command resolution.

How blockchain domains conceal command servers

The botnet queries ENS domains such as burrberry.eth and ukranianhorseriding.eth, as well as the Solana domain 24carnforth2merseyside.sol, to retrieve command infrastructure details from TXT records. The actual command server addresses are not stored as plain IP addresses. Instead, they appear as fake IPv6 strings, and the real targets are extracted with a custom byte-transformation function.

One sample string analyzed by researchers, 12e7:13d7, resolves to the IPv4 address 144.31.38.215 after the decryption routine is applied. To a casual observer, the blockchain record looks like a dead IPv6 entry rather than an active command endpoint. This obfuscation keeps attacker server addresses hidden from basic network inspection.

Blockchain name registries also sit outside conventional takedown processes. A defender trying to disrupt this infrastructure has no registrar or hosting provider to notify, unlike a standard domain seizure. Because blockchain records are distributed, there is no single authority that can revoke or redirect the entries.

Rapid technical iteration and string encryption

Since first appearing in March 2026, Dysphoria has undergone frequent changes in just four months. On March 25, the initial jackskid variant tied to m3rnbvs5d.eth exposed a debug string reading “android has no compatible libc library.” On April 1, researchers observed an fbot variant that printed “hail china mainland” at runtime, suggesting a related but distinct strain in the same ecosystem.

In late April, the malware added a custom RC4-based string encryption scheme alongside blockchain C2 acquisition logic. The modified RC4 algorithm includes two extra phases beyond standard RC4 initialization. A Linear Congruential Generator shuffles the S-box five times, and a Linear Feedback Shift Register advances during keystream generation, carrying out complex bit shifts before the final byte is applied.

This layered encryption protects all strings in the malware and prevents them from being recovered through basic reverse-engineering scans. The heavily modified cipher also makes static signature-based detection much more difficult. In early May, Solana-based SNS infrastructure appeared with 24carnforth2merseyside.sol distributing assets via TXT records, followed by activation of burrberry.eth on June 10.

From DDoS botnet to hybrid relay architecture

The most significant architectural change came on June 25, when researchers captured a Dysphoria variant stripped of all DDoS attack modules. This relay-only sample operated solely as a proxy node, turning the infected device into a hidden traffic relay. Two days later, the botnet added automated UPnP port mapping, allowing the malware to traverse network gateways without manual configuration.

The hybrid model now combines DDoS-capable samples with a dynamic list of compromised relay nodes. Infected devices relay traffic to the actual command servers, keeping the real infrastructure one step removed from direct exposure. That design makes traditional server seizure far more difficult, because defenders cannot shut down command infrastructure simply by taking down a single endpoint.

The relay variant uses UPnP to map ports on the infected device’s local gateway and Linux epoll to shuttle traffic between outside connections and remote C2 services. The shift shows that Dysphoria’s operators have invested heavily in resilience against both law-enforcement action and industry takedowns.

Defensive priorities and remaining exposure

Telemetry published by XLab and CNCERT logged 4,401 confirmed active devices inside China between July 14 and 20, along with a single-day peak of 239,000 bots abroad. Neither figure has been independently reproduced, and the researchers did not publish a counting or de-duplication methodology. The numbers should therefore be treated as estimates rather than a precise device census.

Defenders should focus on patching exposed IoT gear, replacing devices that can no longer be updated, and eliminating default or weak credentials. Disabling remote management and UPnP where they are not needed can significantly reduce exposure to infection. The threat affects routers, cameras, gateways, and other embedded Linux systems that remain online with insufficient security controls.

The adoption of blockchain-based command infrastructure represents a notable defensive evasion technique at the intersection of cryptocurrency technology and traditional malware operations. It does not remove infrastructure from the chain entirely, since the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays. However, it does eliminate the single point of failure that conventional domain seizures provided.

Japan’s NICT independently documented the same shift from JackSkid to ENS and SNS infrastructure in May 2026, confirming that multiple research teams observed the same technical pattern. The convergence on blockchain-based command resolution suggests the approach may become more common as operators look for ways to maintain resilience against law-enforcement disruption and industry takedowns.