Loading malware…
Dysphoria is an IoT botnet family used for distributed denial-of-service (DDoS) attacks and traffic-relay operations. First observed in March 2026, it incorporates code derived from JackSkid and fbot and targets Linux-based routers, gateways, surveillance cameras, and other embedded devices worldwide. It propagates through weak-password attacks against Telnet and SSH services and exploitation of known remote-code-execution vulnerabilities in internet-facing equipment. Its DDoS targets include internet-service and gaming organizations, and its operators market attack packages as a stress-testing service.
Dysphoria combines blockchain-based command-and-control discovery with compromised-device relays to conceal its controllers and complicate disruption. It queries Ethereum Name Service and Solana Name Service records for infrastructure information, decodes addresses concealed in IPv6-like strings, and retrieves dynamically maintained relay-node lists. Compromised hosts forward communications to the underlying controllers, keeping those controllers separate from the endpoints directly contacted by attack bots. Samples also protect strings with a modified RC4-based algorithm and disguise their process names.
A separate relay-only variant identified in late June 2026 removes the DDoS modules and converts infected systems into proxy infrastructure. It discovers UPnP-capable gateways and automatically creates port-forwarding rules to permit inbound connections through NAT. Linux epoll-based nonblocking I/O supports transparent bidirectional forwarding. This functionality supports both concealed control infrastructure and residential traffic relaying, allowing operator connections to appear to originate from compromised household or small-office networks.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Utilisation de domaines Ethereum ENS et Solana SNS pour résoudre l’infrastructure C2
Основными векторами распространения Dysphoria являются слабые пароли для Telnet и SSH...
A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised.
while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.
The “Dysphoria” botnet gains initial access to devices by conducting password attacks against Telnet and SSH services and exploiting known vulnerabilities in IoT firmware.
Основными векторами распространения Dysphoria являются слабые пароли для Telnet и SSH...
Адреса реальной управляющей инфраструктуры дополнительно маскируются под IPv6-строки и восстанавливаются с помощью кастомного алгоритма преобразования байтов.
A common characteristic shared by both is that at runtime, they tamper with their process name to masquerade as libdalvikengine.so .
The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle.
Cette variante abuse de UPnP pour créer 155 règles de port forwarding exposant les services internes à Internet
A Dysphoria IoT infection campaign was previously reported as using password attacks against Telnet and SSH alongside known flaws, while the new dataset focuses on devices already observed as compromised.
Dysphoria se propage via : Identifiants Telnet/SSH faibles
After gaining access, it broadcasts a UPnP discovery request across the local network, finds the gateway router, and maps 155 port forwarding rules.
Dysphoria samples primarily propagate through Telnet/SSH brute-force attacks using weak credentials
The variant identifies network gateways that support the Universal Plug and Play (UPnP) protocol, automatically opens ports and makes infected systems accessible for external traffic relaying.
Recent variants also employ modified encryption mechanisms to conceal strings and configuration data. These techniques slow down malware analysis and enable the botnet to evade basic signature-based detection mechanisms.
После блокировки прежней инфраструктуры малварь стала получать адреса управляющих серверов через Ethereum Name Service (ENS), а в начале мая разработчики оснастили ботнет поддержкой Solana Name Service (SNS).
Shadowserver said in a report that Dysphoria’s primary apparent role is DDoS activity and that it has recently added residential proxy functionality.
引入 UPnP 自动化端口映射 增强内网穿透能力
Shadowserver said in a report shared with Cyber Security News (CSN) that Dysphoria’s primary apparent role is DDoS activity and that it has recently added residential proxy functionality.
在 fbot 的基础上,Dysphoria 重新定制了其底层通信协议。上线包 与 心跳包 均为固定 78 字节。
Кроме того, в конце июня исследователи выявили отдельную версию малвари, из которой полностью убрали все функции для проведения DDoS-атак. Вместо этого вредонос превращает зараженный девайс в сетевой прокси.
Utilisation de domaines Ethereum ENS et Solana SNS pour résoudre l’infrastructure C2
Immediately initiate an outbound connection to the actual remote c2:P (on the same port). At the underlying layer, leverage Linux's high-performance epoll-based asynchronous non-blocking I/O to bind the two connections together, implementing a bidirectional non-blocking transparent data relay.
Once controlled, they can generate traffic in a coordinated distributed denial-of-service, or DDoS, attack, making a website or online service difficult to reach.
The operators claim 4 Tbps of DDoS capacity on their public promotion site, selling attack packages ranging from tens to hundreds of dollars depending on duration and bandwidth... Regarding DDoS attacks, Dysphoria’s targets are located globally
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.