Anoymask

Dysphoria: A 200k-Device Botnet Using Blockchain Name Resolution and Infected Device Relays

1. Basic Information

  • Article Title: New Dysphoria DDoS botnet spreads to 200k devices worldwide
  • Publisher: BleepingComputer
  • Publication Date: 2026-07-27
  • Original Source: https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/
  • Primary Source: https://blog.xlab.qianxin.com/dysphoria/
  • Related Entities: Dysphoria, jackskid, fbot, ENS, SNS, UPnP, Telnet, SSH, IoT/embedded Linux
  • Related CVEs: CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, and others
  • Severity: High
  • Main IOCs: burrberry.eth, ukranianhorseriding.eth, 24carnforth2merseyside.sol, login.trees4sale.net, c2.saintpetersburgresident.ru

2. Summary

This is a large-scale Linux botnet. It breaks into devices using weak Telnet/SSH passwords and various IoT RCE vulnerabilities. It gets multi-stage C2 servers from ENS/SNS records. It turns infected devices into relay nodes or DDoS bots by opening 155 ports using UPnP.

3. Attack Flow

Infection and DDoS Chain

  1. Attackers compromise routers, gateways, and cameras using weak Telnet/SSH credentials or known RCE vulnerabilities.
  2. The malware runs a Linux binary. It hides its process name as libdalvikengine.so.
  3. It decrypts strings using modified RC4 (with added LCG/LFSR).
  4. It reads TXT and custom records from ENS/SNS, converts fake IPv6 formats, and gets distributor node IP addresses.
  5. It gets a list of infected device relays from http://<node>:9000/nodes?key=meowmeowmeow.
  6. It connects to the C2 server using a fixed 78-byte login and heartbeat.
  7. It executes DDoS commands that include duration, attack type, target, and flag.

Relay-Only Chain

  1. A relay variant without DDoS features searches for UPnP-enabled gateways.
  2. It creates 155 port forwards on the WAN side and listens on its own device.
  3. It uses epoll to bidirectionally relay external connections to the real C2 server on the same port.
  4. It reports its status to login.trees4sale.net:9000 at intervals of 4 seconds or more.

4. Attacker Position and Execution Location

  • Attackers operate external scanning, distribution, blockchain namespaces, and multi-stage C2 servers.
  • The malware runs on IoT and embedded Linux devices. UPnP requests are sent to the gateway on the same local network.
  • Because of the relay mechanism, defenders see another victim device as the source of C2 traffic.

5. Indicators for Victims and Administrators

  • Failed and successful Telnet/SSH logins, and Web RCE requests.
  • An unusual process named libdalvikengine.so.
  • ENS/SNS lookups, 9000/TCP traffic, and fixed 78-byte periodic communication.
  • A large number of UPnP port mappings, 155 listening ports, and JSON status reports every 4 seconds.
  • High traffic volume during DDoS attacks, high bandwidth and CPU usage, and bad reputation scores for home or office IPs.

6. Success and Failure Conditions

  • Success: Weak credentials or unpatched RCE, supported CPU/OS, outbound DNS/HTTP/C2 access, allowed UPnP, and unrestricted egress traffic.
  • Failure: Disabled Telnet/SSH or key-based authentication, applied patches, private management interfaces, disabled UPnP, blocked ENS/SNS, IOCs, and port 9000 traffic, or an application allowlist for executables.

7. What Happens on Success

The device is repurposed for DDoS attacks or anonymous relaying. Up to 155 ports on the local gateway may be exposed to the internet. Between July 14 and 20, 2026, daily infections peaked at 239,000 devices globally, with the operators claiming about 200,000 devices. Attackers advertised up to 4 Tbps of capacity, but this is self-reported.

8. Observable Logs

  • Email/Identity/SaaS: None directly. Weak local credentials for Telnet/SSH are involved.
  • Proxy/SWG/DNS: ENS/SNS lookups, main IOCs, requests to /nodes?key=meowmeowmeow, and status reports to :9000.
  • Endpoint/EDR: Limited on IoT devices. Process names, binary hashes, listening ports, startup scripts, and memory artifacts.
  • Network: Scanning traffic, fixed 78-byte communication, UPnP SOAP requests, 155 port mappings, 4-second JSON reports, DDoS traffic, and bidirectional relay traffic.

9. Attack Success Assessment

Stage Evidence
Contact Scanning, authentication failures, and RCE requests
Initial Access Successful authentication or command execution
Malware Setup Process execution, file hashes, and ENS/SNS/C2 communication
Relay Setup 155 port mappings, listening ports, and bidirectional traffic
DDoS Execution High-volume traffic sent to targets after receiving commands
Subsequent Activity Internal LAN scanning, targeting other devices, and downloading additional payloads (unconfirmed)

10. Investigation Playbook

  • Trigger: IOC hits, 9000/TCP traffic, massive UPnP changes, fixed-interval communication, and abnormal egress traffic.
  • Initial Verification: Identify assets, firmware versions, exposed services, and the time of the first connection.
  • Device Analysis: Preserve processes, memory, startup configurations, binaries, hashes, listening ports, and NAT/UPnP tables.
  • Authentication & Cloud: Check successful Telnet/SSH login sources, credential reuse, and cloud management settings.
  • Subsequent Actions: Check for internal LAN scanning, other affected devices, external victims, and the duration of DDoS/relay activity.
  • Containment: Isolate WAN/LAN interfaces, delete and disable UPnP, change credentials, patch or reflash firmware, and block IOCs.
  • Classification: Scan / Initial Access / Bot / Relay / DDoS Participant.

11. Defense and Detection Ideas

  • Detect the chronological sequence of ENS/SNS lookup $\rightarrow$ fetching nodes from port 9000 $\rightarrow$ fixed-length heartbeat, rather than relying on single IOCs.
  • Prioritize alerts when a single device creates a large number of UPnP port mappings in a short time.
  • Block Telnet/SSH, UPnP, and outbound internet egress traffic on IoT network segments by default.
  • Include remote offices and home routers—which often lack DNS, NetFlow, or NAT/UPnP logs—in visibility monitoring.

12. Facts / Inference / Hypothesis

  • Facts: Two malware variants, ENS/SNS C2 infrastructure, fixed 78-byte communication, 155 UPnP ports, weak passwords and RCE vulnerabilities, and an observed scale of about 200,000 devices.
  • Inference: Using victim devices as relays makes C2 takedowns and IP-based attribution difficult.
  • Hypothesis: Combining massive UPnP changes with 4-second 9000/TCP traffic can identify relay variants with high accuracy.

13. MITRE ATT&CK Mapping

  • T1110 Brute Force (High)
  • T1190 Exploit Public-Facing Application (High)
  • T1036 Masquerading (High)
  • T1027 Obfuscated/Compressed Files and Information (High)
  • T1102 Web Service (Medium, uses ENS/SNS)
  • T1090 Proxy (High)
  • T1498 Network Denial of Service (High)
  • T1046 Network Service Discovery (Medium)

14. Unknowns and Further Investigation

Initial distribution URLs and full architecture, persistence mechanisms, DDoS attack types, infection counts by region, ENS/SNS monitoring methods, and the lifespan of all IOCs.

15. Impact on SOCs and Organizations

Branch offices, factories, retail stores, security cameras, and remote work devices can become stepping stones for attacks. When devices turn into relay nodes, the old assumption that "low traffic means safety" no longer applies. Organizations must monitor UPnP and outbound internal IoT traffic on a per-site basis.

16. Summary by Target Audience

  • For SOCs: Correlate ENS/SNS, 9000/TCP, UPnP, fixed-interval traffic, and DDoS events. Distinguish between contact, infection, relay, and attack participation phases.
  • For Administrators: Disable Telnet/SSH and UPnP. Update, isolate, and reflash IoT devices.
  • For Users: Change default passwords on routers and cameras. Turn off unnecessary remote management and UPnP features.