The Dysphoria IoT botnet shows how quickly botnet operators adapt when their infrastructure is disrupted.

Dysphoria is reported as an IoT botnet with more than 200,000 infected devices worldwide. It targets poorly secured internet-connected devices such as routers, cameras, and other IoT systems, spreading through weak Telnet and SSH credentials as well as known vulnerabilities. That combination is depressingly familiar: default passwords, exposed management services, old firmware, and devices nobody remembers until they become part of someone else’s attack network.

What makes Dysphoria especially concerning is its move toward blockchain-based command-and-control resolution and infected-device relay nodes. After disruption of JackSkid-related infrastructure, the botnet operators appear to have added techniques that make takedown and blocking harder.

Traditional botnets often depend on centralized command-and-control domains, servers, or IP addresses. Defenders can disrupt those by sinkholing domains, blocking infrastructure, working with hosting providers, or coordinating law-enforcement takedowns. Blockchain-based resolution changes that model. Instead of relying only on ordinary DNS or fixed infrastructure, attackers can use decentralized naming mechanisms to help bots locate updated command infrastructure.

That does not make the botnet unstoppable, but it does make disruption more difficult. If command location information is stored or resolved through blockchain-linked naming systems, defenders may not be able to simply seize one domain and end the operation. The attacker’s infrastructure becomes more resilient, more distributed, and harder to remove cleanly.

The use of infected devices as relay or proxy nodes adds another layer of difficulty. Rather than every infected device directly contacting a small set of obvious command servers, some compromised devices can act as intermediaries. This helps hide the real command infrastructure and makes malicious traffic appear to come from ordinary residential or business devices.

For defenders, that is a major visibility problem. Traffic from a compromised router or camera may look like traffic from a normal internet connection. Attackers can use these relays for command-and-control, scanning, anonymization, credential attacks, DDoS preparation, and possibly broader proxy services. Apparently, your neglected camera may now have a second job in organized cybercrime. Wonderful career development.

The botnet’s scale matters. More than 200,000 infected devices can provide meaningful distributed capacity for DDoS attacks, scanning, brute-force attempts, proxying, and infrastructure abuse. Even if each device is weak, the combined network can become powerful. Botnets do not need each device to be impressive. They need many devices to be available, exposed, and poorly managed.

The risk is not limited to the owners of infected devices. A compromised IoT device can be used to attack other organizations, hide attacker traffic, participate in DDoS campaigns, or provide residential proxy infrastructure. The device owner may experience bandwidth loss, instability, unexpected traffic, blacklisting, or ISP complaints, while the wider internet experiences the attack.

This is why IoT security must be treated as part of network security, not as a side issue. Routers, cameras, DVRs, access points, smart appliances, and embedded devices often run quietly for years. They may have weak credentials, outdated firmware, exposed admin panels, forgotten remote access, and limited logging. Attackers love this because these devices are numerous, always online, and rarely monitored.

Organizations should immediately inventory internet-facing IoT and edge devices. This includes routers, cameras, NVRs, DVRs, access points, branch devices, modems, smart controllers, industrial gateways, printers, and unmanaged appliances. If a device has an IP address, a web interface, SSH, Telnet, or UPnP exposure, it belongs in the asset inventory. Pretending it is “just a camera” is how the camera joins a botnet and starts living its best criminal life.

Default and weak passwords must be eliminated. Telnet should be disabled wherever possible. SSH access should be restricted to trusted networks, protected with strong credentials or keys, and monitored. Public administrative interfaces should not be exposed unless absolutely necessary, and even then they should be protected with VPN, firewall restrictions, and strong authentication.

Firmware updates are critical. Many IoT devices remain vulnerable because firmware is never updated after installation. Organizations should maintain a patching process for embedded and network-connected devices, including vendor advisories, lifecycle tracking, and replacement plans for devices that no longer receive security updates.

End-of-life devices should be removed or isolated. A device that cannot be patched but remains connected to the internet is not a low-cost asset. It is a long-term liability with blinking lights. If replacement is not immediately possible, the device should be placed behind strict firewall rules, segmented from sensitive systems, and prevented from making unnecessary outbound connections.

Network segmentation is essential. IoT devices should not share the same unrestricted network as servers, endpoints, domain controllers, databases, administrative systems, or business applications. A compromised camera should not be able to scan the corporate network or reach sensitive internal services.

Egress filtering should be applied. Many organizations focus on inbound access but allow devices to connect freely outbound. Botnets depend on outbound communication to reach command infrastructure, relay traffic, download payloads, and participate in attacks. IoT networks should be limited to only the destinations and protocols required for normal operation.

Security teams should monitor for unusual outbound traffic from IoT devices, including connections to unknown destinations, high DNS volume, unexpected blockchain-related name resolution, communication with suspicious IPs, excessive scanning, repeated authentication attempts, unusual bandwidth spikes, and traffic patterns inconsistent with the device’s purpose.

A camera should not be making connections to hundreds of external hosts. A router should not be scanning random internet ranges. A printer should not be participating in encrypted relay traffic. These are not “quirks.” They are warning signs.

DDoS defenders should also take note. Botnets like Dysphoria can provide attackers with distributed attack capacity from many residential and business networks. Organizations that rely on public-facing services should review DDoS protections, upstream filtering, rate limiting, CDN or scrubbing arrangements, and incident-response contacts with ISPs.

ISPs and managed service providers have an important role. They can detect infected customer devices through abnormal traffic patterns, notify customers, block abusive traffic, provide cleanup guidance, and discourage exposure of insecure management services. Since many IoT users will never inspect logs themselves, network-level visibility becomes important.

Manufacturers also need accountability. Devices should ship with secure defaults, unique credentials, automatic update options, clear support lifecycles, and disabled-by-default remote administration. The industry cannot keep selling internet-connected devices that become abandoned malware containers three years later. That is not innovation; it is outsourcing cleanup to everyone else.

For incident response, suspected infected devices should be isolated, reset to factory defaults, updated to the latest firmware, reconfigured with strong credentials, and reviewed for exposed services. If the device cannot be secured, it should be replaced. Rebooting may temporarily remove some malware from memory, but if the weakness remains, reinfection can happen quickly.

Organizations should also review whether compromised IoT devices were used as internal footholds. While many IoT botnets focus on DDoS and proxying, a compromised device inside a business network can still support reconnaissance, traffic relay, credential attacks, or access to poorly segmented systems.

The blockchain C2 element is the broader warning. Attackers are experimenting with more resilient infrastructure. They know that traditional takedowns can disrupt centralized command systems, so they are adding decentralized naming, relays, and proxy layers to make their botnets harder to kill.

The key lesson is that IoT botnets are evolving beyond simple password-scanning malware. Dysphoria combines old weaknesses, such as weak credentials and vulnerable devices, with newer resilience techniques such as blockchain-based C2 resolution and victim relays.

Organizations should reduce exposure, eliminate default credentials, patch firmware, disable Telnet, restrict SSH, segment IoT networks, monitor outbound traffic, and replace unsupported devices.

IoT security fails quietly until the device becomes part of a global botnet. Dysphoria is a reminder that every unmanaged connected device is either an asset or a future volunteer in someone else’s attack infrastructure. Defenders should decide which one before attackers decide for them.

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese

Source: Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption via The Hacker News — published 27 Jul 2026.