SURIQ
A law-enforcement takedown is supposed to end a botnet. In March, a coordinated operation seized the infrastructure behind JackSkid and three other groups that had been renting out distributed denial-of-service (DDoS) attacks. Six days later a new botnet came online, resolving its control servers through the exact address the seized operation had fallen back to. That botnet, now tracked as Dysphoria, did not just rebuild. It re-anchored the one part of its command channel that police can seize onto a place no one can seize it from: a public blockchain.
Researchers at XLab, the threat-intelligence team at Chinese security vendor Qi'anxin, working with China's national CERT (CNCERT), published their analysis on July 25. They estimate Dysphoria has infected around 200,000 devices, while noting the figure has not been independently reproduced and no outside party has measured one of its attacks. Treat the number as the researchers' estimate, not a settled count. The device totals even shift between the two write-ups: XLab reported a few thousand active nodes inside China during one July week against a far larger overseas peak. What is not in dispute is the design, and the design is the story.
The command servers you cannot seize
Most botnets fail at the same choke point. A control server lives at an IP address rented from a hosting provider, reached through a domain sitting in a registrar's database. Both are records a court order can reach: seize the domain, sinkhole the IP, and the bots lose their brain. That is what the March operation did to JackSkid.
Dysphoria moves that record somewhere a subpoena does not go. Its bots look up a name registered on the Ethereum Name Service, live since April, and a second name on Solana's naming service added in May. The blockchain record holds the current controller addresses, buried inside decoy text and pulled out by the malware with a custom decode step, according to Security Affairs. A registrar can be served. A hosting provider can be raided. An entry in a smart contract changes only when the holder of a private key rewrites it. There is nothing to seize and no one to serve, so the pointer survives the takedown and simply hands the bots a new address whenever the operator wants.
This is the same instinct we saw when HollowGraph hid its C2 inside Microsoft 365 calendars: park the control channel on infrastructure defenders cannot take offline without collateral damage. Blockchain naming pushes that further, because the record is not just hard to take down, it is built to be impossible to.
Your device becomes the hiding place
The second change is quieter and, for a defender, worse. A variant XLab dates to June 25 strips out the DDoS module entirely. The infected device stops attacking anyone. Instead it opens a port on its local gateway through UPnP, the feature that lets home devices punch their own holes in a router, and uses the Linux epoll event system to shuttle traffic between the outside world and the real controllers. The bot in your network becomes a relay, and the true command server hides one hop behind a wall of other people's cameras and routers.
Dropping the DDoS module is not only an architecture decision. It is an evasion win. The single loudest sign that an IoT device is compromised is that it starts blasting traffic at a victim. A relay node makes no floods. It moves modest volumes of traffic and, by that one signal every simple monitor relies on, looks clean. So the relay mesh does not hide in exotic tradecraft. It hides in the long tail of quiet devices nobody is watching, which is most of them.
We have seen the persistence half of this before. When the FBI seized the NetNut proxy botnet, the servers went dark but the infected devices stayed infected, waiting to be reused. Dysphoria closes that loop: the victims are not just leftover inventory, they are the load-bearing infrastructure.
Cut the relay path first: UPnP and weak logins
The way in is unglamorous. Dysphoria spreads through weak or default Telnet and SSH passwords and known, unpatched code-execution bugs in routers, cameras and gateways. The two write-ups cite different examples, which tells you the operator is not relying on a single flaw: XLab points to a Linksys command-injection bug (CVE-2025-9528), while Security Affairs lists older router vulnerabilities including CVE-2017-17215. Neither is exotic. Both hit gear that people plugged in years ago and forgot, the same forgotten-hardware problem behind the Arystinger router botnet.
The concrete first move is one you can make on the exact end-of-life gear you cannot patch: turn off UPnP on the gateway unless a specific service genuinely needs it. The relay variant depends on UPnP to open its inbound port automatically. Take that away and the node cannot accept the connections it is supposed to relay, whether or not the device itself is patched. After that, close remote Telnet and SSH exposure, replace default credentials, and retire devices past end of support.
Detection has to shift with the threat. You cannot sinkhole a blockchain name, but the bot still has to do three observable things: reach a blockchain resolver or RPC endpoint to read the record, pull server lists over plain HTTP from distribution nodes, then hold long-lived inbound connections it has no business holding. A home router talking to a blockchain RPC service is not normal traffic. Those behaviors are the seams, and they surface in what a device does on the network, not in a file scan on the device. Watching outbound connections across a whole fleet, the kind of behavioral detection and response that correlates activity rather than trusting each host to police itself, is where a quiet relay gives itself away.
The March takedown did not fail. It worked, and Dysphoria is what working looks like now: pressure that clears out the fragile infrastructure and selects for the resilient. Blockchain-anchored naming will spread to other families for the same reason, because it moves the one asset a takedown needs to grab beyond anyone's reach but the operator's. The answer is not a better sinkhole. It is watching what your own devices do, because more and more they are not the target. They are the infrastructure.