Dysphoria

Utilisation de domaines Ethereum ENS et Solana SNS pour résoudre l’infrastructure C2

Основными векторами распространения Dysphoria являются слабые пароли для Telnet и SSH...

A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised.

The “Dysphoria” botnet gains initial access to devices by conducting password attacks against Telnet and SSH services and exploiting known vulnerabilities in IoT firmware.

Основными векторами распространения Dysphoria являются слабые пароли для Telnet и SSH...

Адреса реальной управляющей инфраструктуры дополнительно маскируются под IPv6-строки и восстанавливаются с помощью кастомного алгоритма преобразования байтов.

A common characteristic shared by both is that at runtime, they tamper with their process name to masquerade as libdalvikengine.so .

Cette variante abuse de UPnP pour créer 155 règles de port forwarding exposant les services internes à Internet

A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised.

Dysphoria se propage via : Identifiants Telnet/SSH faibles

After gaining access, it broadcasts a UPnP discovery request across the local network, finds the gateway router, and maps 155 port forwarding rules.

Dysphoria samples primarily propagate through Telnet/SSH brute-force attacks using weak credentials

The variant identifies network gateways that support the Universal Plug and Play (UPnP) protocol, automatically opens ports and makes infected systems accessible for external traffic relaying.

Recent variants also employ modified encryption mechanisms to conceal strings and configuration data. These techniques slow down malware analysis and enable the botnet to evade basic signature-based detection mechanisms.

После блокировки прежней инфраструктуры малварь стала получать адреса управляющих серверов через Ethereum Name Service (ENS), а в начале мая разработчики оснастили ботнет поддержкой Solana Name Service (SNS).

Shadowserver said in a report that Dysphoria’s primary apparent role is DDoS activity and that it has recently added residential proxy functionality.

Shadowserver said in a report shared with Cyber Security News (CSN) that Dysphoria’s primary apparent role is DDoS activity and that it has recently added residential proxy functionality.

Кроме того, в конце июня исследователи выявили отдельную версию малвари, из которой полностью убрали все функции для проведения DDoS-атак. Вместо этого вредонос превращает зараженный девайс в сетевой прокси.

Utilisation de domaines Ethereum ENS et Solana SNS pour résoudre l’infrastructure C2

Immediately initiate an outbound connection to the actual remote c2:P (on the same port). At the underlying layer, leverage Linux's high-performance epoll-based asynchronous non-blocking I/O to bind the two connections together, implementing a bidirectional non-blocking transparent data relay.

Once controlled, they can generate traffic in a coordinated distributed denial-of-service, or DDoS, attack, making a website or online service difficult to reach.

The operators claim 4 Tbps of DDoS capacity on their public promotion site, selling attack packages ranging from tens to hundreds of dollars depending on duration and bandwidth... Regarding DDoS attacks, Dysphoria’s targets are located globally