Cybersecurity researchers have identified a sophisticated botnet known as Dysphoria that has compromised approximately 200,000 devices worldwide and uses blockchain-based domain names on the Ethereum and Solana networks to conceal its command-and-control (C2) infrastructure. The findings were jointly disclosed by QiAnXin XLab and China’s National Computer Network Emergency Response Technical Team/Coordination Center (CNCERT), underscoring the malware’s rapid technical evolution and growing sophistication.

Ethereum and Solana Domains Used to Conceal Command Infrastructure

According to the researchers, Dysphoria evolved from the earlier jackskid and fbot malware families. Since it was first detected by QiAnXin XLab in March 2026, the botnet has undergone multiple upgrades in just a few months, adding stronger encryption techniques, blockchain-based command server discovery and a specialized relay variant that turns compromised systems into covert proxy nodes.

Researchers reported that Dysphoria has infected around 200,000 devices globally and now uses Ethereum Name Service (ENS) and Solana Name Service (SNS) domains to conceal its command-and-control infrastructure, making detection significantly more difficult. That shift matters because it moves command lookups away from conventional DNS infrastructure and into blockchain naming systems that defenders may not routinely monitor in the same way.

QiAnXin XLab said it had been tracking Dysphoria since the first quarter of 2026 and observed frequent mutations and technical enhancements during that period. The researchers said the malware showed considerable resilience through continuous development, evolving across multiple variants while introducing blockchain-based command resolution and expanding its functionality by converting infected devices into relay nodes.

One of the most significant technical changes involves the malware’s command server resolution mechanism. Instead of embedding command server addresses directly in malicious code or relying on conventional domain name services, Dysphoria queries Ethereum Name Service domains such as burrberry.eth and ukranianhorseriding.eth, along with a Solana Name Service domain. These domains contain specially crafted TXT records that appear to store IPv6 addresses but actually conceal the real Internet Protocol addresses through a customized byte transformation process. As a result, the malware avoids exposing the actual server locations in either its code or standard network traffic.

The report also highlighted major changes to the malware’s encryption methods. Dysphoria incorporates a heavily modified implementation of the RC4 encryption algorithm, adding processing stages beyond the standard design. Researchers said the malware combines a Linear Congruential Generator (LCG) with repeated S-box shuffling and a Linear Feedback Shift Register (LFSR) during keystream generation, making encrypted strings much more difficult to analyze using conventional malware inspection methods. As a result, standard string-scanning tools provide little useful information for security analysts.

The latest Dysphoria variants combine customized RC4 encryption with blockchain-based command resolution and encrypted string protection, significantly increasing resistance to malware analysis and infrastructure detection.

Researchers also identified a new relay-focused variant that emerged on June 25. Unlike earlier versions that included distributed denial-of-service (DDoS) attack modules, the updated variant primarily converts infected devices into hidden relay servers. After compromising a system, the malware discovers the local network gateway through Universal Plug and Play (UPnP) requests and automatically establishes as many as 155 port-forwarding rules.

The relay architecture allows compromised devices to transparently forward network traffic between attackers and remote command servers using Linux’s high-performance asynchronous input/output framework. Researchers said each relay node periodically sends status reports containing connection statistics and bandwidth information to a centralized heartbeat server every four seconds. This design prevents DDoS bots from communicating directly with the actual command servers, instead routing traffic through other infected systems that function as intermediary relays.

Monitoring conducted between July 14 and July 20 recorded peak daily communication volumes of approximately 740,000 pings from infected hosts. During that period, researchers observed as many as 239,000 active overseas devices and 1,801 active devices within China on a single day, indicating the botnet’s substantial global footprint.

The investigation also found that Dysphoria spreads by exploiting weak Telnet and Secure Shell (SSH) credentials, as well as numerous known vulnerabilities affecting routers, surveillance cameras and Internet of Things (IoT) devices. The malware targets both recently disclosed vulnerabilities and older flaws that remain unpatched across many deployed systems, reflecting a familiar but still effective path into exposed edge devices.

Researchers further reported that Dysphoria operators advertise DDoS-for-hire services capable of delivering up to 4 terabits per second of attack capacity while maintaining nearly continuous attacks against organizations across multiple industries worldwide.

The report concluded that Dysphoria represents an increasingly mature cybercriminal operation whose combination of blockchain technology, advanced encryption, relay-based infrastructure and aggressive propagation techniques presents a growing challenge for cybersecurity defenders seeking to identify and disrupt its global operations.