A fast growing botnet has spent 2026 making itself very hard to switch off. Dysphoria now controls roughly 200,000 devices, hides the addresses of its command servers inside blockchain domain records, and has begun converting the machines it infects into relay stations for its own traffic.
The findings come from a joint report by China's national CERT, CNCERT, and XLab, the research team at Qi An Xin, which has tracked the family since the first quarter of 2026.
Why the blockchain matters here
Most botnets are dismantled at the infrastructure layer: investigators find the domain the malware calls home, then get a registrar to suspend it or a host to pull the server. Dysphoria sidesteps that. It looks up TXT records on Ethereum Name Service domains such as burrberry.eth and ukranianhorseriding.eth, and on a Solana Name Service domain, 24carnforth2merseyside.sol. Those records live on public blockchains, so there is no registrar to serve and no provider to pressure.
The record itself is obfuscated. It contains what look like IPv6 addresses separated by pipe characters. The malware pulls out four specific bytes and runs them through a custom permutation to rebuild a real IPv4 address. Anyone glancing at the record sees plausible IPv6 traffic, not a command server.
Victims become the infrastructure
The second half of the trick landed in late June, when XLab captured a variant with its DDoS attack code stripped out entirely that did nothing but relay traffic. Because most infected routers and PCs sit behind home NAT and cannot be reached from outside, the relay build broadcasts across the local network looking for a gateway that supports UPnP, then instructs the router to open 155 ports back to itself. It relays traffic in both directions and reports its own health to a collection server every few seconds.
The result is a hybrid chain. An attack sample resolves a blockchain record, gets a list of distribution nodes, and asks one of them over plain HTTP for the "real" command servers. Every address that comes back is another compromised bot. Defenders who trace the traffic reach a victim, not an operator. All the samples also rename their own process to libdalvikengine.so to blend into a normal Linux process listing.
How it spreads and how big it is
Dysphoria relies on the oldest trick in the IoT playbook: brute forcing weak Telnet and SSH passwords on routers, gateways and cameras. It backs that with a list of remote code execution bugs that mixes long serving botnet staples such as CVE-2017-17215 and CVE-2020-8515 with far newer entries including CVE-2025-55182 and CVE-2025-34152, a sign the operators are still broadening the range of hardware they can reach.
Between 14 and 20 July 2026 the researchers confirmed 4,401 active bots inside China, with as many as 1,801 domestic devices coming online in a single day and a peak of 740,000 daily check ins. The population outside China is larger, peaking at 239,000 devices per day. Control panel screenshots leaked on social media put the total under the operators' control at around 200,000, consistent with the researchers' own monitoring. The service is openly commercial: its promotional page advertises roughly 4 Tbps of attack capacity, with packages sold from a few dozen dollars upward. Attack targets span internet services and gaming worldwide, nearly every day.
What you should do
The defensive advice is unglamorous and it works. Change default Telnet and SSH credentials on every network appliance and camera, and disable those services entirely where they are not needed. Turn off UPnP on the gateway, which removes the botnet's ability to open its own inbound ports. Retire hardware that no longer receives firmware updates, since several of the exploited flaws are years old and will never be patched. On the network side, unexplained outbound connections to port 9000, or blockchain name resolution traffic from an embedded device, are both worth alerting on.
Dysphoria follows a pattern we have seen twice this summer, in RustDuck rewriting itself for more DDoS firepower and AryStinger turning 4,300 old routers into an attack relay: operators are investing less in raw infection numbers and more in surviving attention. Full technical detail is in the original XLab and CNCERT report.
Selected indicators (defanged): 144[.]31[.]38[.]215, 217[.]60[.]195[.]160, 76[.]164[.]203[.]171, 92[.]42[.]100[.]131, 78[.]153[.]155[.]152, plus the domains login[.]trees4sale[.]net, i[.]peer4you[.]net and c2[.]saintpetersburgresident[.]ru. Its download servers also answer with a distinctive FTP banner naming security journalist Brian Krebs, which makes a serviceable detection string.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.