Dysphoria Botnet Adopts Blockchain C2 After JackSkid Disruption

A new report from The Hacker News reveals that the Dysphoria Internet‑of‑Things (IoT) botnet has upgraded its command-and-control (C&C) infrastructure by integrating blockchain-based name services and infected-device relays after a March law-enforcement operation disrupted the JackSkid infrastructure that previously supported the botnet’s operations.¹

The move follows a series of disruptions targeting JackSkid. In March authorities seized key components of JackSkid, forcing Dysphoria operators to seek alternative C&C channels.¹

Dysphoria is tracked by China’s CNCERT, the national computer emergency response team, and XLab, the threat‑intelligence lab of Chinese cybersecurity researchers. Both groups noted the shift was harder to disrupt because victim relays act like decentralized mix networks obfuscating traffic paths and making attribution nearly impossible without extensive tracing through multiple hops.¹

Experts note that this technique mirrors earlier botnets such as Mirai, which used DNS text records in 2016, but moves it onto actual blockchains adds another layer of obfuscation.

Moreover, there is concern about potential overlap with compromised smart contracts being leveraged as unwitting bot relay nodes after a supply‑chain compromise at one of China’s major semiconductor fabs last year.

From an online privacy standpoint, Dysphoria’s new C&C architecture means users’ devices are harder to detect and remove from the network. Because commands travel across many independent nodes, security teams must monitor not only known command servers but also any node that might host a valid transaction containing a control payload. This increases the attack surface for defenders and reduces the effectiveness of takedown operations that rely on single points of failure.¹

In practice, organizations should treat any IoT device showing unusual outbound traffic—especially those using peer-to-peer protocols—as potentially compromised until proven otherwise. Regular firmware updates remain essential, though some vulnerabilities like the recent vBulletin exploit demonstrate how unpatched software can allow remote code execution via PHP’s eval function.¹

The Dysphoria case underscores how threat actors continuously evolve their infrastructure to outpace law enforcement and defensive measures. By leveraging blockchains, they harness decentralization as a shield against takedowns—a trend likely to repeat with other malware families seeking greater operational longevity. Security professionals must therefore adopt holistic monitoring strategies that include blockchain analytics alongside traditional intrusion detection systems.