Dysphoria Botnet Rebuilds on Blockchain After March Takedown

Key points

• CNCERT and XLab are tracking an Internet-connected device botnet called Dysphoria that rebuilt itself after a March 2024 takedown of related JackSkid infrastructure.
• The operators now use blockchain-based domain names, which do not sit on the normal internet directory system and are far harder for police to seize.
• Infected devices are being used as relays, hiding the real control servers behind chains of victims.
• Researchers warn the redesign makes disruption operations considerably slower and more complicated.

A family of botnets known as Dysphoria has come back with a tougher design after police disrupted part of its network earlier this year. That's the finding from two teams tracking it: CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence unit inside Chinese security firm QiAnXin.

A botnet is a large group of hacked devices, often home routers and cameras, that criminals control remotely and rent out for attacks. Dysphoria targets Internet of Things gear: the small internet-connected devices scattered through homes and offices.

The rebuild followed a law-enforcement action in March against infrastructure tied to a linked operation called JackSkid. Rather than fold, the operators changed how their network finds its bosses.

What actually changed?

The botnet swapped ordinary web addresses for blockchain-based name services, and it now bounces traffic through the very devices it has infected. Both moves are aimed squarely at making takedowns harder.

Normal web addresses like example.com sit inside the Domain Name System, a public directory that registrars and courts can force offline. Blockchain-based names, by contrast, live inside decentralised ledgers with no central operator to serve with a warrant. Once a name is registered, there's essentially no one to call to pull it down.

The second change matters just as much. Instead of connecting infected devices straight to a command server the police could locate and seize, Dysphoria now uses compromised devices themselves as relays. Traffic from a hacked camera in one country might pass through a hacked router in another before it reaches the operator. Investigators chasing the trail hit victim after victim, not the criminal.

Why did the operators bother?

Because the March action worked, at least in part. When authorities pulled down JackSkid-related servers, the network lost reach. Rebuilding on blockchain names and victim relays is a direct response, designed so the next takedown doesn't land as cleanly.

As first reported by The Hacker News, CNCERT and XLab describe the new setup as materially harder to disrupt. They stop short of calling it takedown-proof. Nothing is. But the friction for investigators goes up sharply. XLab's work here is consistent with what we saw in their RustDuck research on 30 June: the lab tends to catch botnet evolution before it's widely reported.

What it means for ordinary users

Most Dysphoria victims aren't people, they're devices: routers, DVRs, IP cameras, cheap smart-home gadgets that sit online for years without updates. If yours is infected, you may never notice beyond a slower connection or an unusually warm box.

Practical steps are unglamorous and effective. Reboot home routers and cameras occasionally, since many IoT infections don't survive a power cycle. Install firmware updates when the manufacturer offers them. Replace kit that no longer receives security patches.

For businesses, the lesson is narrower: inventory what's actually on your network. IoT gear tends to be bought outside IT, and it's exactly the sort of device Dysphoria feeds on.

Takedowns work. They also teach the other side. Each disruption pushes serious botnet operators toward infrastructure that's harder to reach next time, and blockchain naming plus victim relays is where that arms race currently sits. Watch whether other IoT botnets adopt the same playbook.