A large-scale IoT botnet known as Dysphoria has re-engineered its command-and-control (C2) infrastructure to use blockchain-based name resolution and a peer-relay architecture, directly adapting to law enforcement disruption of connected infrastructure in March 2026. Researchers from CNCERT and XLab report over 200,000 active bots sustaining near-daily distributed denial-of-service attacks against internet service providers and communications platforms.
Blockchain C2: Designed for Disruption Resilience
The shift to blockchain-based C2 represents a deliberate and increasingly documented response to coordinated law enforcement action. Traditional botnet C2 infrastructure — domain-based or IP-based — is vulnerable to sinkholing, domain seizure, and hosting provider takedowns. Blockchain-based name services offer no equivalent chokepoint: there is no registrar to compel, no DNS provider to serve a court order on, no hosting company to suspend an account.
Dysphoria uses the Ethereum Name Service (ENS) — resolving to the domain m3rnbvs5d[.]eth — and Solana Name Service (SNS) to resolve C2 node addresses. Both services are decentralised and censorship-resistant by design. The evolution was rapid: ENS resolution was added in late April 2026, SNS support followed in early May, and by June 25 a relay-only variant with UPnP-based NAT traversal had been deployed.
The relay mesh adds a second layer of resilience. Infected devices do not contact C2 infrastructure directly — they relay traffic through other compromised hosts, putting multiple hops between the actual operators and observable C2 endpoints. This complicates both traffic analysis and attribution, and creates a self-healing network that individual node takedowns cannot decapitate.
Context: JackSkid and the Post-Disruption Adaptation Cycle
On March 19, 2026, U.S., German, and Canadian law enforcement targeted four IoT botnets simultaneously, including JackSkid — a DDoS-as-a-service platform responsible for generating over 90,000 DDoS commands. Dysphoria emerged within days of that disruption, either as a renamed/restructured successor operation or as a competing platform filling the vacuum.
The speed of re-emergence is notable. The prior generation of botnet operators typically required weeks to months to rebuild infrastructure after significant disruptions (Emotet, Qakbot). Dysphoria’s rapid evolution — from initial emergence to blockchain C2 to relay-only variants in under four months — indicates either pre-built contingency infrastructure or an operator group with high technical capability and rapid iteration cycles.
Sector Impact and Attack Patterns
Researchers report near-daily DDoS attacks against internet service providers and gaming platforms. The communications sector relevance is direct: ISPs are the primary targets, and sustained volumetric attacks on ISP infrastructure can degrade service for downstream customers including businesses, critical services, and government agencies that depend on commercial ISP connectivity.
The attack-for-hire model that Dysphoria appears to serve — like JackSkid before it — means targeting is financially rather than politically driven. Any organisation with enemies willing to pay for disruption, or any ISP providing service to unpopular targets, is within scope.
Recommended Actions
Operators of internet-facing IoT infrastructure should ensure firmware is current and default credentials have been replaced — Dysphoria, like most IoT botnets, recruits via exposed services and credential stuffing against common default configurations. Network operators should review DDoS protection capacity and upstream transit provider agreements against the volumetric scale Dysphoria has demonstrated.
Defenders tracking botnet C2 infrastructure should account for ENS and SNS resolution in their threat hunting tooling. Blockchain-based C2 is not uniquely detectable through standard domain or IP blocklisting; monitoring for ENS/SNS resolution requests and anomalous traffic to Ethereum or Solana node infrastructure may surface infected hosts before they are put to use.
Law enforcement and regulatory communications infrastructure should review their resilience posture against the botnet scale reported here. Disruption of a competitor (JackSkid) did not reduce overall DDoS capacity — it accelerated the evolution of a successor.