MalwareExploits 12 CVEs

Dysphoria

Dysphoria is an emerging IoT botnet family active since at least the first quarter of 2026 and assessed as part of a lineage evolving from JackSkid- and fbot-related malware. It targets embedded Linux devices including routers, gateways, cameras, and similar internet-exposed appliances. Reported telemetry places its bot population at roughly 200,000 compromised devices globally, although the full scale has not been independently validated.

Dysphoria is used for distributed denial-of-service operations and for covert traffic relay through infected devices. Its architecture evolved into a hybrid model in which some compromised hosts retain DDoS functionality while others are repurposed as relay or proxy nodes that intermediate communications between bots and the real controllers. This design increases resilience and complicates takedown efforts by distancing operational command infrastructure from frontline bot communications.

A notable feature of Dysphoria is blockchain-based command-and-control discovery. The malware has used both Ethereum Name Service and Solana Name Service records to obtain infrastructure information, and it conceals controller addresses inside disguised data that is decoded locally by the malware. Later variants added custom string encryption and dynamic retrieval of relay-node lists, reflecting rapid iterative development over a short period.

Late-June variants introduced a dedicated relay/proxy build that removed DDoS modules and focused on network forwarding. This relay functionality abuses UPnP to create large numbers of port mappings on compromised gateways, exposing internal services behind NAT and allowing infected devices to function as externally reachable relay nodes. The relay component uses efficient non-blocking network I/O to shuttle traffic between inbound connections and upstream command infrastructure.

Dysphoria spreads primarily through weak Telnet and SSH credentials and through exploitation of known remote-code-execution vulnerabilities affecting IoT and edge devices. Reported exploited flaws span multiple years and vendors, indicating opportunistic targeting of poorly secured embedded Linux systems rather than a narrow victim profile.

Operational reporting indicates frequent global DDoS activity, with targeting observed across sectors such as internet services and gaming. Dysphoria has also been described as being marketed as a commercialized DDoS-for-hire service, with operators advertising multi-terabit attack capacity, though those capacity claims have not been independently confirmed. No operator attribution has been established with high confidence.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

12 CVES

CVE-2017-17215Remote Code Execution in Huawei HG532Exploited in the wild

其中既包含长期被僵尸网络广泛利用的经典 IoT 漏洞(如 CVE-2017-17215、CVE-2020-8515 等),也包含近年来披露的新漏洞 | 自 2026 年第一季度以来,XLAB持续追踪到一个BOT数量超过20万名为 Dysphoria 的新兴僵尸网络家族。

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2025-9528OS Command Injection in Linksys E1700 systemCommandExploited in the wild

已监测到其利用的部分漏洞包括: CNVD-2021-79445 CVE-2013-3307 CVE-2016-20016 CVE-2017-17215 CVE-2017-5259 CVE-2025-9528 CVE-2018-14558 CVE-2020-25499 CVE-2020-8515 CVE-2025-28137 CVE-2025-34152 CVE-2025-55182 CVE-2022-35733 | 自 2026 年第一季度以来,XLAB持续追踪到一个BOT数量超过20万名为 Dysphoria 的新兴僵尸网络家族。

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2016-20016JAWS Webserver RCE in MVPower CCTV DVRExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2020-8515Unauthenticated Command Injection RCE in DrayTek Vigor mainfunction.cgiExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2017-5259Undocumented Root Web Shell in Cambium Networks cnPilot FirmwareExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2018-14558Command Injection in Tenda AC7/AC9/AC10 setUsbUnloadExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2025-28137Pre-auth RCE in TOTOLINK A810R setNoticeCfgExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2020-25499Authenticated OS Command Execution in TOTOLINK A3002RU Run CommandExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2025-34152Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi RepeaterExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2013-3307OS Command Injection in Linksys apply.cgi ping_ip ParameterExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2025-55182React2ShellExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

CVE-2022-35733Unauthenticated OS Command Execution in UNIMO DVR Web InterfaceExploited in the wild

via qianxin xlab blogblog.xlab.qianxin.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1133External Remote ServicesEvidence3

Dysphoria 样本主要通过 Telnet/SSH 弱口令爆破

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.

T1203Exploitation for Client ExecutionEvidence2

Dysphoria 样本主要通过 Telnet/SSH 弱口令爆破以及已知 IoT 设备远程代码执行(RCE)漏洞进行传播

Persistence

1 technique

T1133External Remote ServicesEvidence3

Dysphoria 样本主要通过 Telnet/SSH 弱口令爆破

Stealth

2 techniques

T1036MasqueradingEvidence1

在运行时都会通过篡改进程名,伪装为 libdalvikengine.so 。

T1211Exploitation for Defense EvasionEvidence1

The use of blockchain in C2 operations makes the overall infrastructure harder to trace and dismantle.

Credential Access

1 technique

T1110Brute ForceEvidence3

Dysphoria 样本主要通过 Telnet/SSH 弱口令爆破

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence2

XLab's report notes that the botnet spreads through weak Telnet and SSH credentials and known vulnerabilities in routers, cameras, and various IoT devices.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence3

DDoS 样本随后向这些分发节点发起 HTTP GET 请求: http://<node_ip>:9000/nodes?key=meowmeowmeow 。

T1090ProxyEvidence2

甚至开始将受害者主机转化为 C2 中继/代理节点。

T1090.001Internal ProxyEvidence1

引入 UPnP 自动化端口映射增强内网穿透能力

T1090.003Multi-hop ProxyEvidence2

In late June, XLab observed a variant that focused only on transforming infected devices into network proxies, and completely discarded the DDoS functionality.

T1095Non-Application Layer ProtocolEvidence1

在 fbot 的基础上,Dysphoria 重新定制了其底层通信协议。上线包与心跳包均为固定 78 字节。

T1568Dynamic ResolutionEvidence2

更在近期引入了基于区块链 ENS/SNS 域名的 C2 隐蔽解析机制。

Impact

2 techniques

T1498Network Denial of ServiceEvidence2

本文将针对 Dysphoria 的历史演进时间线、核心字符串解密算法、C2 基础设施获取机制以及其独特的网络代理机制、样本感染方式、感染范围、DDoS攻击等方面进行深度剖析。

T1499Endpoint Denial of ServiceEvidence1

Court documents attributed more than 90,000 DDoS commands to JackSkid alone... XLab says Dysphoria attacks internet-service and gaming targets almost daily...

INDICATORS OF COMPROMISE

IOCs tracked for this family

29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

17 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

12 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the hacker newsNews

Jul 27, 2026

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

IoT botnet that uses blockchain-based name services such as ENS and SNS for C2 resolution and infected-device relay nodes to obscure real controllers. It spreads via weak Telnet/SSH credentials and known IoT RCE flaws, and is described as attacking internet-service and gaming targets almost daily. A relay-only variant uses UPnP port mapping and Linux epoll to proxy traffic between outside connections and remote C2 services.

bleeping computerNews

Jul 27, 2026

New Dysphoria DDoS botnet spreads to 200k devices worldwide

An IoT botnet that uses blockchain-based C2 resolution via Ethereum ENS and Solana SNS, conceals C2 addresses inside fake IPv6 strings, and is used for DDoS attacks and traffic relay/proxy operations. Later variants separated DDoS and relaying functionality and abused UPnP to create port forwarding rules exposing internal services.

qianxin xlab blogNews

Jul 25, 2026

僵尸网络新秀:Dysphoria 演进与深度技术分析

An emerging botnet family with more than 200,000 bots, used for DDoS attacks and increasingly for covert C2 relay/proxy operations. It uses ENS/SNS blockchain domains for hidden C2 resolution, can convert infected hosts into relay nodes, supports UPnP-based port mapping, and spreads via Telnet/SSH weak credentials and exploitation of known IoT RCE vulnerabilities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching29

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities12

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Dysphoria