Dysphoria is a fast-evolving botnet that has compromised about 200,000 devices worldwide and is being used for DDoS attacks and proxy relay operations. QiAnXin XLab found that it inherits traits from jackskid and fbot while adding blockchain-based C2 resolution through Ethereum ENS and Solana SNS, making it harder to trace and disrupt. #Dysphoria #QiAnXinXLab #EthereumENS #SolanaSNS #jackskid #fbot
Keypoints
- Dysphoria has infected around 200,000 devices worldwide.
- The botnet is used for DDoS attacks and traffic relay operations.
- It evolved from jackskid and fbot with blockchain-based C2 resolution.
- It uses Ethereum ENS and Solana SNS domains, plus fake IPv6 strings, to hide C2 infrastructure.
- The botnet spreads via weak credentials and flaws in routers, cameras, and IoT devices.