Dysphoria: an IoT botnet that resolves its C2 through Ethereum and Solana name services and turns its own victims into the relay mesh
Two design changes in this family are worth a defender's attention, and neither is about the DDoS capability it is nominally built for. The first is where the bots learn who to talk to. Instead of resolving a conventional domain, Dysphoria queries records held in Ethereum's ENS and Solana's SNS decentralised name services; the retrieved text carries decoy IPv6-formatted strings, from which the sample extracts four key bytes and reconstructs the real IPv4 address through a custom permutation routine (QiAnXin XLab / CNCERT, 2026-07-25). BleepingComputer's account of the same report describes the mechanism in the same terms (BleepingComputer, 2026-07-27). Because the names live on public chains rather than in a registrar's zone, the usual levers — suspension, sinkholing, registry-level takedown — do not apply to that layer at all.
The second change is what the resolved addresses point at. A DDoS sample first reads a distribution-node list from the ENS record, then requests a further list over plain HTTP from those nodes on a high port; XLab's tracing found that the addresses returned as the actual C2 endpoints are themselves other infected devices converted into relays (QiAnXin XLab / CNCERT, 2026-07-25). A dedicated variant exists only for this purpose: it carries no attack module and instead broadcasts on the LAN for a UPnP-capable gateway, drives the WAN connection service to create roughly 155 port-forwarding rules, listens on those ports, and relays each inbound connection to the same port on a remote host using epoll-driven non-blocking I/O, reporting its availability as a small JSON health record — status, connection count and bandwidth — every few seconds. XLab dates this variant to 2026-06-25 and calls it the start of the family's "relay transformation", without offering an assessment of why the operators made the change (QiAnXin XLab / CNCERT, 2026-07-25). Propagation remains unglamorous: weak Telnet and SSH credentials brute-forced, plus known IoT remote-code-execution flaws against routers, gateways and cameras — XLab names thirteen identifiers spanning 2013-vintage to 2025-vintage bugs and presents them explicitly as only part of the set it has observed in use. Operators advertise up to roughly 4 Tbps of attack capacity on commercial packages priced from tens to hundreds of US dollars.
Triage: three observables discriminate this from ordinary IoT noise. A single LAN host requesting on the order of 150 UPnP port mappings in quick succession has no benign counterpart — legitimate applications request one or a few. Name-resolution or HTTP traffic associated with ENS or SNS lookups originating from an embedded device is likewise anomalous by device class, whatever it would mean from a workstation. And both sample classes rewrite their process name at runtime to masquerade as libdalvikengine.so, an Android runtime library, so on a Linux-based device with no Android runtime a process presenting that name is the artifact rather than the disguise (QiAnXin XLab / CNCERT, 2026-07-25). Fixed-length periodic beacons from IoT devices are a supporting signal, not a standalone one.
该样本不再具备 DDoS 攻击功能，而是纯粹作为中继/代理节点运作
the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.
ATT&CK mapping
7 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
Credential Access TA0006
T1110.001Brute Force: Password Guessing
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.
Command and Control TA0011
T1090.003Proxy: Multi-hop Proxy
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
T1568Dynamic Resolution
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
Impact TA0040
T1498Network Denial of Service
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.