Overview
- QiAnXin XLab and CNCERT first tracked Dysphoria after March law enforcement action and XLab says the family was first seen resolving C2 via ENS on March 25.
- The malware reads TXT records from Ethereum ENS and Solana SNS domains that contain fake IPv6 strings and recovers real IPs with a custom byte transformation and modified RC4-like routine.
- In late June researchers observed a relay-only variant that drops DDoS code, abuses UPnP to create up to 155 WAN port forwards, and uses Linux epoll to proxy traffic while reporting heartbeats to login.trees4sale.net:9000.
- XLab and CNCERT report spread through weak Telnet/SSH credentials plus known IoT RCE flaws such as CVE-2025-9528 and CVE-2025-55182, and they estimate the botnet at roughly 200,000 devices while stressing those counts and a 4 Tbps operator claim are unverified.
- Defenders can still disrupt Dysphoria by patching devices, removing default passwords, disabling UPnP and remote management, blocking ENS/SNS lookups and port 9000 traffic, and by targeting public distribution nodes and blockchain records used by the botnet.