Dysphoria: an IoT botnet that resolves its C2 through Ethereum and Solana name services and turns its own victims into the relay mesh

Two design changes in this family are worth a defender's attention, and neither is about the DDoS capability it is nominally built for. The first is where the bots learn who to talk to. Instead of resolving a conventional domain, Dysphoria queries records held in Ethereum's ENS and Solana's SNS decentralised name services; the retrieved text carries decoy IPv6-formatted strings, from which the sample extracts four key bytes and reconstructs the real IPv4 address through a custom permutation routine (QiAnXin XLab / CNCERT, 2026-07-25). BleepingComputer's account of the same report describes the mechanism in the same terms (BleepingComputer, 2026-07-27). Because the names live on public chains rather than in a registrar's zone, the usual levers (suspension, sinkholing, registry-level takedown) do not apply to that layer at all.

The second change is what the resolved addresses point at. A DDoS sample first reads a distribution-node list from the ENS record, then requests a further list over plain HTTP from those nodes on a high port; XLab's tracing found that the addresses returned as the actual C2 endpoints are themselves other infected devices converted into relays (QiAnXin XLab / CNCERT, 2026-07-25). A dedicated variant exists only for this purpose: it carries no attack module and instead broadcasts on the LAN for a UPnP-capable gateway, drives the WAN connection service to create roughly 155 port-forwarding rules, listens on those ports, and relays each inbound connection to the same port on a remote host using epoll-driven non-blocking I/O, reporting its availability as a small JSON health record (status, connection count and bandwidth) every few seconds. XLab dates this variant to 2026-06-25 and calls it the start of the family's "relay transformation", without offering an assessment of why the operators made the change (QiAnXin XLab / CNCERT, 2026-07-25). Propagation remains unglamorous: weak Telnet and SSH credentials brute-forced, plus known IoT remote-code-execution flaws against routers, gateways and cameras, XLab names thirteen identifiers spanning 2013-vintage to 2025-vintage bugs and presents them explicitly as only part of the set it has observed in use. Operators advertise up to roughly 4 Tbps of attack capacity on commercial packages priced from tens to hundreds of US dollars.

Triage: three observables discriminate this from ordinary IoT noise. A single LAN host requesting on the order of 150 UPnP port mappings in quick succession has no benign counterpart, legitimate applications request one or a few. Name-resolution or HTTP traffic associated with ENS or SNS lookups originating from an embedded device is likewise anomalous by device class, whatever it would mean from a workstation. And both sample classes rewrite their process name at runtime to masquerade as libdalvikengine.so, an Android runtime library, so on a Linux-based device with no Android runtime a process presenting that name is the artifact rather than the disguise (QiAnXin XLab / CNCERT, 2026-07-25). Fixed-length periodic beacons from IoT devices are a supporting signal, not a standalone one.