Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

The persistent arms race between threat actors and security defenders has taken a significant turn with the evolution of the Dysphoria IoT botnet. In a striking example of malware adaptation, researchers from CNCERT and XLab have observed a sophisticated architectural overhaul in this threat cluster. Following a successful law enforcement dismantling of the JackSkid infrastructure in March, the operators behind Dysphoria did not simply rebrand or rebuild. Instead, they fundamentally redesigned their command and control mechanisms, integrating blockchain technology to ensure resilience against future disruption attempts.

At its core, Dysphoria targets vulnerable Internet of Things devices, transforming them into a network of zombie machines capable of launching devastating distributed denial-of-service attacks or executing other malicious directives. The recent updates to the botnet’s code represent a direct response to the crackdown on JackSkid. Rather than relying on traditional, centralized servers which can be easily seized or sinkholed, the new iteration leverages blockchain-based name services to resolve C2 addresses. This decentralizes the critical infrastructure needed to maintain the botnet. Furthermore, the malware now utilizes compromised devices as relays, bouncing traffic through victims to obfuscate the true location of the operators. According to analysis by China’s national computer emergency response team and the XLab threat intelligence lab, these architectural choices are deliberate measures intended to complicate defensive efforts and prolong the botnet’s lifespan.

For security teams, the migration toward blockchain-backed C2 infrastructure presents a formidable challenge. Traditionally, defenders have relied on seizing domain names or IP addresses to sever the link between botnet operators and their infected assets. This tactic becomes far less effective when those addresses are derived from a decentralized blockchain ledger that cannot be easily altered or shut down by a single authority. The use of victim relays further complicates mitigation, as it allows malicious traffic to blend in with legitimate user activity, making detection and blocking more difficult for network perimeter defenses. Security operations centers must now expand their monitoring capabilities to include anomalous outbound traffic patterns that may indicate peer-to-peer relay activity within their IoT ecosystems. Defenders can no longer assume that taking down a server will neutralize the threat and must instead focus on identifying the initial compromise vectors and hardening IoT devices against infection.

The rapid evolution of the Dysphoria botnet highlights a critical shift in the threat landscape where adversaries prioritize operational resilience above all else. By incorporating blockchain technology and relay networks, malware authors are effectively future-proofing their operations against traditional takedown methodologies. This development serves as a stark reminder that IoT security remains a vulnerable frontier, often serving as the entry point for complex, persistent threats. Organizations must adopt a more proactive posture regarding device patching and network segmentation to limit the potential impact of such decentralized threats. Ultimately, the integration of web3 technologies into malicious infrastructure signals that security strategies must evolve equally fast to address these decentralized and obfuscated attack vectors.