Dysphoria Botnet Goes Dark: Blockchain & Victim Relays Boost Resilience

Introduction

The world of IoT‑based malware has entered a new era of sophistication. After a joint operation dismantled the JackSkid botnet in March, its successor—Dysphoria—has pivoted to more covert command‑and‑control (C2) channels. Researchers from CNCERT, China’s national cyber‑emergency response team, and XLab, the country’sāj threat‑intelligence laboratory, have traced these changes. The botnet now relies on blockchain‑driven name services and a novel relay architecture that deflects traditional takedown attempts. In this piece we unpack how these innovations work, why they matter for defenders, and what steps organizations can take to stay ahead.

From JackSkid to Dysphoria: Evolution of IoT Botnet Tactics

JackSkid was a sprawling network that leveraged compromised home routers, cameras, and industrial control devices to launch distributed denial‑of‑service (DDoS) attacks and ransomware campaigns. Its architecture was relatively straightforward: a central command server, a list of infected hosts, and a simple HTTP/HTTPS back‑channel for updates. The March law‑enforcement operation severed this chain, forcing its operators to rethink their approach.

Dysphoria, the evolved variant, has adopted a multi‑layered defense strategy:

• Decentralized C2 via blockchain name services: Instead of a single command server, the botnet uses distributed ledger technology (DLT) to broadcast instructions. Each infected XCTest device queries a blockchain node for the latest payloads, making it difficult for defenders to block specific IP addresses.
• Victim relays: Infected devices act as intermediaries, forwarding commands from the blockchain to other compromised hosts. This relay network obfuscates the original command source and increases network resilience.
• Encrypted communication: All traffic is wrapped in TLS with custom certificates, further complicating traffic analysis.

Blockchain as a Command-and-Control Backbone

Using blockchain for C2 is not entirely new, but Dysphoria’s implementation stands out for its simplicity and robustness. The botnet leverages a public blockchain’s naming protocol (similar to ENS on Ethereum) to store short, human‑readable identifiers that map to C2 instructions. Here’s how it works:

1. Operators publish a new C2 record on the blockchain, containing a hash of the malicious payload.
2. Infected devices periodically query the blockchain for updates.
3. Upon detecting a new hash, the device fetches the payload from an IPFS (InterPlanetary File System) gateway or a peer‑to‑peer node.

Because the blockchain is immutable and globally replicated, there is no single point of failure. Even if a set of nodes is taken down, other nodes continue to provide the same instructions. Moreover, the distributed nature of public ledgers makes it hard for authorities to trace the origin of commands.

Victim Relays: A New Layer of Anonymity and Persistence

Dysphoria’s relay mechanism turns every compromised host into a potential signal relay. The process unfolds as follows:

• An infected node receives a command from the blockchain.
• Instead of executing the command directly, it forwards the instruction to a randomly chosen subset of its peers.
• These peers, in turn, repeat the process, creating a mesh of relay traffic that constantly changes.

Result: The command path becomes a moving target, making it extremely difficult for defensive tools to block or trace. Additionally, the relay network provides redundancy; if several nodes go offline, the remaining ones continue to propagate the instructions.

Implications for Cybersecurity and Cloud Defense

For security teams, Dysphoria’s dual‑layered design introduces several challenges:

• Detection complexity: Traditional signature‑based IDS cannot identify blockchain queries or relay traffic.
• Mitigation difficulty: Blocking a single IP or domain is ineffective because the botnet continuously shifts its command source.
• Cloud‑hosted resilience: If the botnet infects edge devices that connect to cloud services, the relay network can propagate malicious payloads across data centers, potentially compromising cloud‑native workloads.

Defenders must adopt proactive, behavior‑centric approaches. Network segmentation, anomaly detection, and real‑time threat intelligence feeds that include blockchain transaction monitoring can help identify suspicious patterns before they spread.

Conclusion

As Dysphoria demonstrates, the arms race between cybercriminals and defenders is moving from brute‑force tactics to sophisticated, distributed architectures. Blockchain‑powered command channels and victim relays make traditional takedown strategies obsolete, pushing security teams toward more advanced, AI‑driven detection and response frameworks. By embracing a zero‑trust model, enhancing network segmentation, and integrating blockchain intelligence into threat monitoring, organizations can build resilience against this next wave of IoT botnet evolution. While the battle continues, platforms like Summer Cloud’s AI automation and cybersecurity services offer scalable, adaptive solutions that help нит organizations protect their digital infrastructure in an increasingly hostile cyber environment.