ctipilot.ch

Dysphoria

tool · tool:dysphoria-botnet single-source

IoT botnet family tracked jointly by CNCERT and QiAnXin XLab since Q1 2026, exceeding 200,000 bots and evolved from the jackskid and fbot malware lineages. It spreads through brute-forced weak Telnet/SSH credentials and known IoT remote-code-execution flaws (XLab names thirteen identifiers and presents them as only part of the set), resolves its command-and-control addressing through Ethereum ENS and Solana SNS name records with the real IPv4 address concealed inside a decoy IPv6-formatted string, and since late June 2026 fields a DDoS-less variant that uses UPnP to open roughly 155 port-forwarding rules on the local gateway and operate the infected device as a relay/proxy node in a mesh built from other victims (QiAnXin XLab / CNCERT, 2026-07-25).

Coverage timeline
1
first 2026-07-28 → last 2026-07-28
Peak priority
notable
1 notable
Sources cited
2
2 hosts
Sections touched
1
active-threats
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
7
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1027T1036.005T1090.003T1110.001T1190T1498T1568
Tags
botnetddos

ATT&CK techniques

7 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

Credential Access TA0006

T1110.001Brute Force: Password Guessing×1

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

Command and Control TA0011

T1090.003Proxy: Multi-hop Proxy×1

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

T1568Dynamic Resolution×1

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

Impact TA0040

T1498Network Denial of Service×1

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-07-28/dysphoria-iot-botnet-ens-sns-c2-upnp-relay-mesh · ATT&CK page ↗

Story timeline

  1. 2026-07-28Dysphoria: an IoT botnet that resolves its C2 through Ethereum and Solana name services and turns its own victims into the relay mesh
    active-threatsDysphoria botnet moves C2 resolution onto blockchain name services and rebuilds its infrastructure from victim devices

Where this entity is cited

  • active-threats1

Source distribution

  • bleepingcomputer.com1 (50%)
  • blog.xlab.qianxin.com1 (50%)

explore in graph

All cited sources (2)

Entries about Dysphoria (1)

2026-07-28 · view entry permalink →

NOTABLENATOB2

Dysphoria: an IoT botnet that resolves its C2 through Ethereum and Solana name services and turns its own victims into the relay mesh

Two design changes in this family are worth a defender's attention, and neither is about the DDoS capability it is nominally built for. The first is where the bots learn who to talk to. Instead of resolving a conventional domain, Dysphoria queries records held in Ethereum's ENS and Solana's SNS decentralised name services; the retrieved text carries decoy IPv6-formatted strings, from which the sample extracts four key bytes and reconstructs the real IPv4 address through a custom permutation routine (QiAnXin XLab / CNCERT, 2026-07-25). BleepingComputer's account of the same report describes the mechanism in the same terms (BleepingComputer, 2026-07-27). Because the names live on public chains rather than in a registrar's zone, the usual levers — suspension, sinkholing, registry-level takedown — do not apply to that layer at all.

The second change is what the resolved addresses point at. A DDoS sample first reads a distribution-node list from the ENS record, then requests a further list over plain HTTP from those nodes on a high port; XLab's tracing found that the addresses returned as the actual C2 endpoints are themselves other infected devices converted into relays (QiAnXin XLab / CNCERT, 2026-07-25). A dedicated variant exists only for this purpose: it carries no attack module and instead broadcasts on the LAN for a UPnP-capable gateway, drives the WAN connection service to create roughly 155 port-forwarding rules, listens on those ports, and relays each inbound connection to the same port on a remote host using epoll-driven non-blocking I/O, reporting its availability as a small JSON health record — status, connection count and bandwidth — every few seconds. XLab dates this variant to 2026-06-25 and calls it the start of the family's "relay transformation", without offering an assessment of why the operators made the change (QiAnXin XLab / CNCERT, 2026-07-25). Propagation remains unglamorous: weak Telnet and SSH credentials brute-forced, plus known IoT remote-code-execution flaws against routers, gateways and cameras — XLab names thirteen identifiers spanning 2013-vintage to 2025-vintage bugs and presents them explicitly as only part of the set it has observed in use. Operators advertise up to roughly 4 Tbps of attack capacity on commercial packages priced from tens to hundreds of US dollars.

Triage: three observables discriminate this from ordinary IoT noise. A single LAN host requesting on the order of 150 UPnP port mappings in quick succession has no benign counterpart — legitimate applications request one or a few. Name-resolution or HTTP traffic associated with ENS or SNS lookups originating from an embedded device is likewise anomalous by device class, whatever it would mean from a workstation. And both sample classes rewrite their process name at runtime to masquerade as libdalvikengine.so, an Android runtime library, so on a Linux-based device with no Android runtime a process presenting that name is the artifact rather than the disguise (QiAnXin XLab / CNCERT, 2026-07-25). Fixed-length periodic beacons from IoT devices are a supporting signal, not a standalone one.

该样本不再具备 DDoS 攻击功能，而是纯粹作为中继/代理节点运作

QiAnXin XLab / CNCERT 2026-07-25

the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.

BleepingComputer 2026-07-27
threat28 Jul 04:53Zsingle-sourceOpen finding ↗
Sources: QiAnXin XLab / CNCERT · BleepingComputer