Loading story…
Researchers reported that the Dysphoria IoT botnet, a lineage linked to JackSkid, changed its command-and-control design after a March law-enforcement disruption targeting JackSkid infrastructure. According to CNCERT and XLab, the operators replaced more traditional C2 dependencies with Ethereum Name Service (ENS) and Solana Name Service (SNS) records, allowing infected devices to resolve controller information through blockchain-based naming systems and making infrastructure takedowns more difficult.
XLab said Dysphoria evolved rapidly from late March through June, adding ENS resolution, SNS resolution, a relay-only variant, and UPnP port mapping to help compromised devices traverse NAT environments. The botnet is reported to spread primarily through weak Telnet and SSH credentials, along with some known IoT remote-code-execution flaws, and it also uses infected devices as relay nodes to obscure backend controllers; however, the reported bot counts and attack scale have not been independently verified, and no operator or victim organizations were publicly identified.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Researchers said Dysphoria incorporated UPnP-based port mapping to traverse NAT devices. This capability was part of the botnet's post-disruption evolution described as occurring from late March through June.
XLab's analysis described a relay-only Dysphoria variant that uses compromised infected devices as relay nodes for command-and-control. The design was intended to further complicate takedown efforts by obscuring core infrastructure.
Researchers reported that Dysphoria shifted to blockchain-based name services for command-and-control, specifically using Ethereum Name Service and Solana Name Service records. This marked a technical evolution in the botnet's infrastructure after the disruption.
XLab said Dysphoria underwent rapid development from late March through June after the March 19 disruption. The changes included work on new command-and-control mechanisms intended to make takedowns harder.
BleepingComputer reported that QiAnXin XLab estimated Dysphoria had spread to roughly 200,000 devices globally and was being used for DDoS attacks and proxy/traffic relay operations. The report also said researchers observed heavy botnet activity in mid-July and that operators advertised up to 4 Tbps of DDoS capacity.
XLab published an analysis on July 25 describing Dysphoria's rapid development and its use of blockchain naming services, relay nodes, and NAT traversal techniques. The report linked these changes to the aftermath of the March 19 disruption.
The XLab report says CNCERT and QiAnXin had been tracking the Dysphoria botnet since Q1 2026. This establishes the earliest explicit observation window for the emerging botnet family before the March disruption and later architectural changes.
Monitoring for July 14–20, 2026 found 4,401 active bots in mainland China, a peak of 239,000 overseas bots online daily, and near-daily global DDoS activity affecting sectors including internet services and gaming. This provided a specific operational snapshot of Dysphoria's scale and active use beyond the previously reported general bot population estimate.
The new reference says a newer relay variant of Dysphoria was discovered on 2026-06-25. This version removes DDoS modules and uses UPnP plus Linux epoll-based transparent forwarding to expose infected devices as relay infrastructure.
According to the reporting, a law-enforcement disruption targeting JackSkid occurred on March 19. This disruption prompted subsequent changes in the related Dysphoria botnet's command-and-control architecture.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
blog.xlab.qianxin.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceblog.xlab.qianxin.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The China-linked **JDY botnet** has grown from roughly 650 devices in early 2024 to more than **1,500 compromised SOHO and IoT systems**, according to Lumen Black Lotus Labs, and is being used primarily for **cyber reconnaissance** rather than disruptive attacks. Researchers said the infrastructure, previously tied to a cluster within **KV-botnet** and associated with Chinese state-backed activity including support for **Volt Typhoon**, performs scanning, service fingerprinting, banner grabbing, TLS certificate collection, and vulnerability-focused discovery. Many infected nodes are located in the **United States and Brazil**, and the activity shows a strong emphasis on **U.S. military and related networks**. The operators reportedly move quickly after new vulnerabilities are disclosed, with researchers observing targeting tied to **`CVE-2026-35616`** soon after Fortinet revealed the **FortiClient EMS** flaw, indicating reconnaissance data is being gathered for possible follow-on exploitation. JDY uses **Tor hidden services** for command-and-control, can leverage the **Platypus** reverse-shell and host-management framework, and adjusts its scanning techniques based on device privileges, including high-speed raw SYN scanning when elevated access is available. The report warns that compromised edge devices from multiple vendors are being folded into the botnet and urges organizations to patch routers, firewalls, and IoT devices, disable unnecessary internet-exposed administration, restrict remote management, replace default credentials, and watch for unusual outbound scanning.
Jun 29, 2026
Researchers reported that the **Masjesu** botnet, also tracked as **XorBot**, has been operating since early 2023 as a **DDoS-for-hire** service promoted on Telegram. The malware targets internet-exposed routers, gateways, cameras, DVRs, NVRs, and other embedded devices across multiple CPU architectures, exploiting known command-injection and remote code execution flaws in products from vendors including **D-Link, Huawei, NETGEAR, TP-Link, and GPON**. Trellix said the botnet is engineered for stealth and longevity, using XOR-based obfuscation, runtime decryption, persistence mechanisms, process spoofing, and multi-domain command-and-control infrastructure with fallback IPs. Once installed, Masjesu opens a hard-coded TCP port `55988` for direct operator access, suppresses termination signals, kills utilities such as `wget` and `curl`, and connects to external servers for attack instructions. The operators reportedly avoid scanning or infecting high-profile ranges such as **U.S. Department of Defense** networks to reduce scrutiny, while advertising the botnet's geographic spread and attack capacity. Observed traffic has been concentrated in **Vietnam** and also seen from **Ukraine, Iran, Brazil, Kenya, and India**, with the botnet used to launch **TCP, UDP, and HTTP flood** attacks against CDNs, game servers, and enterprises, including volumes reported at roughly **290 Gbps**.
Jun 29, 2026
U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — **Aisuru, KimWolf, JackSkid, and Mossad** — that collectively compromised more than **three million** internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable **DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers**, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting **U.S. Department of Defense** systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above **30 Tbps**, with one attack reaching roughly **31.4 Tbps**, placing them among the largest DDoS threats recorded. The operators allegedly ran the infrastructure as a **DDoS-for-hire** service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s **BKA** and Canada’s **RCMP** carried out parallel enforcement steps. Private-sector partners including **Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation** supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.
Jun 29, 2026