Dysphoria Botnet Compromises 200,000 IoT Devices Using Web3 Domain C2

A newly identified malware family named the Dysphoria botnet has infected approximately 200,000 consumer routers, IP cameras, and smart devices globally. Operating as a dual-threat platform, Dysphoria coordinates large-scale distributed denial-of-service (DDoS) attacks while converting infected endpoints into covert residential proxy nodes. First observed by cybersecurity researchers at QiAnXin XLab on March 25, the malware has undergone rapid architectural iterations, evolving from older botnet codebases—specifically ‘jackskid’ and ‘fbot’—into a resilient threat actor infrastructure driven by decentralized blockchain mechanisms.

During monitoring between July 14 and July 20, telemetry recorded a peak volume of 740,000 daily ping requests from compromised hosts, with 239,000 connections originating from overseas clients and 1,800 from within China. The operators behind Dysphoria market their infrastructure on the public web as a commercial DDoS stress-testing service, boasting a peak attack capacity of 4 Terabits per second (Tbps). While below the record-breaking 31.4 Tbps threshold established by the Aisuru/Kimwolf botnet in December 2025, 4 Tbps remains more than sufficient to knock unmitigated enterprise web applications, DNS hosts, and ISP infrastructure offline.

Decentralized Command-and-Control Architecture

Dysphoria’s most distinct technical advance is its adoption of Web3 domain resolution to evade standard domain takedowns and IP sinkholing. Traditional botnets rely on legacy Domain Name System (DNS) infrastructure or hardcoded IP addresses, allowing law enforcement and security providers to disrupt C2 networks by seizing domain names or issuing null-routes to registrar hosts. Dysphoria bypasses these mechanisms by querying Ethereum Name Service (ENS) .eth domains and Solana Name Service (SNS) .sol domains to retrieve its underlying infrastructure data.

Because Web3 domains reside on public smart contracts across decentralized blockchains, traditional administrative takedown requests fail. Furthermore, the botnet conceals its true C2 addresses inside syntactically valid, fake IPv6 string structures. When an infected client executes, a custom byte-transformation algorithm extracts and decodes the actual underlying IP parameters from these strings.

Once initial communication is established, compromised endpoints send a standardized 78-byte payload containing login details and regular heartbeat pings back to the C2 server. Operators then send back binary DDoS directives detailing attack duration, traffic type (UDP/TCP floods, HTTP floods), target IP addresses, and specific packet flags.

Proxy Hijacking and Network Perimeter Exposure

In late June, XLab identified a significant operational pivot: a Dysphoria variant that discarded its DDoS routines entirely to focus on converting infected devices into residential proxies. To achieve this, the malware abuses Universal Plug and Play (UPnP), a protocol designed to let local network devices automatically configure network address translation (NAT) port mappings on home routers.

Dysphoria executes UPnP commands on the host to create up to 155 automated port-forwarding rules. This opens internal device management interfaces and private local services directly to inbound internet traffic. By turning compromised IoT devices into residential proxy endpoints, the botnet operators can rent access to cybercriminals seeking to relay traffic. Residential proxies allow attackers to perform automated credential stuffing, vulnerability scanning, and password spraying against enterprise targets while routing traffic through legitimate consumer IP addresses, effectively bypassing geographic and IP-reputation access controls.

Exploitation Vectors and Vulnerability Spectrum

Dysphoria propagates primarily through automated scanning for weak SSH and Telnet administrative credentials, alongside targeted weaponization of known remote code execution (RCE) and command injection flaws in perimeter hardware. The malware targets both recently disclosed vulnerabilities and unpatched legacy flaws:

• CVE-2025-55182 (“React2Shell”): A critical remote code execution vulnerability impacting web components, actively exploited for initial access.
• CVE-2025-34152 & CVE-2025-28137: Flaws affecting Totolink router models, allowing unauthenticated attackers to execute system commands.
• CVE-2025-9528: A vulnerability impacting Linksys networking hardware used to gain initial access.
• CVE-2017-17215: A legacy unauthenticated command execution flaw in Huawei HG532 routers caused by improper handling of UPnP implementation in the TR-064 service.
• CVE-2020-8515: An unauthenticated command injection vulnerability in DrayTek Vigor routers allowing remote attackers to execute arbitrary code via specific web management endpoints.

Because many SOHO (Small Office/Home Office) routers and legacy IoT devices are deployed without centralized patch management or reach end-of-life (EOL) status while remaining connected, old vulnerabilities remain highly effective vectors for automated botnet recruitment.

Defense and Remediation

Mitigating the threat posed by Dysphoria requires immediate hardening of edge networking hardware and internal protocol controls:

1. Disable UPnP Globally: Disable UPnP on all edge routers and firewalls. Automated port mapping bypasses edge firewalls and exposes internal network segments directly to the public internet.
2. Patch Edge Hardware: Ensure all deployed Linksys, Totolink, DrayTek, and Huawei devices are updated to vendor firmware versions that patch CVE-2025-55182, CVE-2025-34152, CVE-2025-28137, CVE-2025-9528, CVE-2020-8515, and CVE-2017-17215. Replace end-of-life hardware that no longer receives vendor security patches.
3. Restrict Remote Management Access: Disable WAN-facing SSH, Telnet, and HTTP/HTTPS management interfaces across all network appliances. Enforce strict passphrase policies and switch to public-key authentication where SSH management is necessary.
4. Network Monitoring: Block inbound and outbound traffic querying known public Web3 domain RPC gateways or unapproved Ethereum/Solana API endpoints on non-essential network segments to interrupt C2 resolution channels.