Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After Jack Skid Disruption

Summary: Dysphoria, an IoT botnet tracked by CNCERT and XLab, adopted blockchain-based name services and infected-device relays after a March 19 law-enforcement operation against JackSkid infrastructure, with XLab's timeline opening on a March 25 JackSkid sample resolving command-and-control through the ENS domain m3rnbvs5d[.]eth. The researchers put its population above 200,000 bots, logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad, and noted none of the counts has been independently reproduced.
Why it matters: The botnet still depends on blockchain records, reachable distribution nodes, and compromised relays, so the shift complicates a server seizure without removing infrastructure from the chain. The storefront's advertised 4 Tbps is an operator claim, not a measured attack, and no independent source has confirmed the reported 200,000-device scale.

Read the original at The Hacker News ↗

Mentions: CVE-2025-9528