As reported by Security Affairs, researchers at QiAnXin XLab and China's CNCERT have disclosed the Dysphoria botnet — a 200,000-device threat actor network that leverages Ethereum and Solana blockchain domains to conceal its command-and-control (C2) infrastructure. Evolved from the jackskid and fbot malware lineages, Dysphoria represents a meaningful tactical escalation in how threat actors are architecting resilient, defender-resistant botnets.

Threat Alert: As reported by Security Affairs, researchers at QiAnXin XLab and China's CNCERT have disclosed the Dysphoria botnet — a 200,000-device threat actor network that leverages Ethereum and Solana blockchain domains to conceal its command-and-control (C2) infrastructure.

Why Blockchain Domains Change the Threat Calculus

Traditional botnet takedown operations rely heavily on domain seizure — working with registrars and hosting providers to pull the plug on C2 infrastructure. Blockchain-based domains (such as those on the Ethereum Name Service or Solana Name Service) operate entirely outside this model. They are registered on decentralized ledgers, controlled by private keys, and cannot be unilaterally seized by a registrar, law enforcement, or hosting provider. There is no central authority to serve a court order to.

This is not a theoretical concern. We have seen earlier iterations of this technique with fbot malware, which similarly abused EOS blockchain domains. Dysphoria's apparent adoption of both Ethereum and Solana — two of the most liquid, widely supported blockchain ecosystems — suggests threat actors are not experimenting anymore. They are operationalizing this evasion class at scale.

The decentralized nature of blockchain domains means that conventional law enforcement and registrar-based takedown playbooks are, at best, severely degraded against this infrastructure model.

Who Is at Risk

With 200,000 compromised devices globally, Dysphoria's targeting profile likely includes:

Why Blockchain Domains Change the Threat Calculus
Consumer and SOHO routers — historically the most common target for fbot-lineage malware
IoT devices with weak or default credentials and unpatched firmware
Linux-based embedded systems in industrial and enterprise edge environments
Organizations with unmanaged device sprawl — particularly those with limited visibility into network edge hardware

Given its fbot lineage, Dysphoria is likely DDoS-capable and may also be used for cryptomining or proxy services. Any organization operating internet-exposed embedded devices or consumer-grade routers at the network edge should treat this as a direct relevance threat, not a background noise item.

The Broader Implication: Infrastructure That Outlasts Defenders

What makes Dysphoria strategically significant is not just its scale — it's the architectural philosophy it represents. When C2 infrastructure is anchored to an immutable blockchain, the botnet's nervous system becomes effectively permanent unless the operator voluntarily abandons it or loses access to the controlling private key. This forces defenders to shift focus entirely away from infrastructure disruption and toward endpoint detection and network-layer blocking.

Security teams need to understand that the "take it down at the source" strategy, which has been a pillar of botnet disruption for over a decade, has a growing blind spot. Blockchain C2 requires a detection-first, behavior-first response model.

Shield53 Recommendations

Immediate Actions

  • Audit and inventory all edge devices: Routers, IoT endpoints, and Linux-based embedded hardware should be catalogued and verified for current firmware versions and strong credential configuration.
  • Block blockchain DNS resolution at the network perimeter: DNS resolvers that support blockchain TLDs (e.g., .eth, .sol) are not standard enterprise infrastructure. Consider blocking resolution of these TLDs via DNS filtering or firewall policy unless there is a documented business need.
  • Monitor for anomalous outbound connections: Look for unusual DNS query patterns, particularly to non-standard TLDs or decentralized DNS resolvers (e.g., Cloudflare's 1.1.1.1 with ENS support, or third-party blockchain resolvers). Flag these in SIEM as indicators of potential C2 activity.
  • Deploy behavioral detection on network edge: Signature-based detection will lag. Focus on behavioral indicators such as beaconing patterns, unusual outbound data volumes from embedded devices, or lateral movement originating from IoT segments.
  • Segment IoT and OT networks: Ensure IoT devices cannot directly communicate with critical internal systems. Enforce strict egress filtering on IoT VLANs.

Strategic Guidance

  • Security teams should begin evaluating threat intelligence feeds that include blockchain domain indicators of compromise (IoCs) — traditional domain-based IoC feeds will miss this infrastructure class entirely.
  • Incident response playbooks should be updated to include steps for investigating blockchain-anchored C2, including querying on-chain records for malicious domain registrations.
  • Consider engaging threat intelligence vendors with dedicated IoT and botnet tracking capabilities, as the fbot/jackskid/Dysphoria lineage has a documented research history worth monitoring.

Dysphoria is a signal, not an anomaly. As blockchain infrastructure matures and becomes cheaper to leverage, expect additional threat actors to adopt this evasion model. The defenders who build detection and response capabilities around this now will be significantly better positioned when the next iteration arrives.