Dysphoria botnet moves command and control onto the blockchain to resist takedown

An IoT botnet tracked as Dysphoria has adopted blockchain-based name services and relays built from its own victims after a March law enforcement operation disrupted related botnet infrastructure. Rather than hardcoding servers, it resolves command-and-control details through Ethereum and Solana naming systems, with addresses hidden inside fake IPv6 strings and recovered by a custom algorithm, which makes conventional server seizure harder. A separate relay build drops the attack modules and instead shuttles traffic between outside connections and remote servers through compromised devices. It spreads mainly through weak Telnet and SSH passwords and known device flaws. Researchers put its size above 200,000 bots, though that count is not independently verified.

Check

Take IoT and networking devices off direct internet exposure, replace default and weak Telnet and SSH credentials, patch known device flaws, and disable remote management where it is not needed.

Affected

Internet-exposed IoT and networking devices with weak Telnet or SSH passwords or unpatched flaws; these get recruited for denial-of-service attacks or as relays that hide the operator's real infrastructure.

Fix

Enforce strong unique device credentials, disable Telnet and unnecessary remote services, keep firmware patched or replace unsupportable devices, and monitor outbound connections for relay and blockchain name-service activity.