An IoT botnet tracked as Dysphoria has adopted blockchain-based name services and relays built from its own victims after a March law enforcement operation disrupted related botnet infrastructure. Rather than hardcoding servers, it resolves command-and-control details through Ethereum and Solana naming systems, with addresses hidden inside fake IPv6 strings and recovered by a custom algorithm, which makes conventional server seizure harder. A separate relay build drops the attack modules and instead shuttles traffic between outside connections and remote servers through compromised devices. It spreads mainly through weak Telnet and SSH passwords and known device flaws. Researchers put its size above 200,000 bots, though that count is not independently verified.
Krebs on Security reports that Jacob Butler, the 18-year-old Ottawa resident allegedly known online as 'Dort,' has been arrested and charged in both the US and Canada with running the Kimwolf IoT botnet. KrebsOnSecurity unmasked Butler as the operator on February 28 by tying together his email addresses, forum registrations, and public Telegram and Discord posts. Dort later threatened and swatted researchers including Synthient's Ben Brundage. Ontario Provincial Police executed a search warrant in Ottawa on March 19 and seized devices. Kimwolf competed with Aisuru, JackSkid, and Mossad for the same vulnerable-IoT population. Butler faces up to 10 years if extradited and convicted in the US.
TrustStrike Labs