Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption Dysphoria物联网僵尸网络在JackSkid破坏后添加区块链C2和受害者中继

TL;DR

• The Dysphoria IoT botnet has evolved to use blockchain-based command-and-control (C2) and infected-device relays, making it harder to disrupt after law enforcement actions against its predecessor, JackSkid.
• Researchers from CNCERT and XLab report the botnet's population exceeds 200,000 bots, with telemetry logging over 4,400 active devices in China and a single-day peak of 239,000 bots abroad.
• The botnet spreads through weak Telnet/SSH credentials and known IoT vulnerabilities, including CVE-2025-9528, a Linksys E1700 command-injection flaw.
• The shift to Ethereum Name Service (ENS) and Solana Name Service (SNS) for C2 complicates traditional server seizure tactics but does not eliminate infrastructure dependencies.
• Defenders are advised to patch exposed IoT devices, replace unupdatable hardware, eliminate default credentials, and disable unnecessary remote management features like UPnP.

Why It Matters

This article highlights the evolving sophistication of IoT botnets as they adapt to law enforcement disruptions by leveraging decentralized technologies like blockchain for C2 communication. For AI practitioners and cybersecurity professionals, understanding these shifts is critical for developing proactive defense mechanisms and threat intelligence strategies that account for increasingly resilient malware architectures. Additionally, the reliance on weak credentials and unpatched vulnerabilities underscores the importance of robust device security practices in mitigating large-scale botnet threats.

Technical Details

• Blockchain-Based C2: Dysphoria uses ENS and SNS domains (e.g., m3rnbvs5d.eth, burrberry.eth) to encode distribution-node IPv4 addresses and other infrastructure records, enabling dynamic and decentralized command resolution.
• Infected-Device Relays: The botnet employs compromised devices as relays between bots and actual controllers, obscuring the true location of C2 servers and complicating takedown efforts.
• Propagation Methods: Infection occurs via brute-force attacks on Telnet/SSH services and exploitation of known IoT vulnerabilities, such as CVE-2025-9528 in Linksys routers.
• UPnP Exploitation: A relay-only variant leverages Universal Plug and Play (UPnP) to map ports locally, facilitating traffic forwarding between external connections and remote C2 services.
• Encryption and Obfuscation: Custom RC4 string encryption is used to obfuscate communications within the botnet, adding another layer of complexity to detection and analysis.

Industry Insight

The transition to blockchain-based C2 mechanisms reflects a broader trend among cybercriminals toward adopting decentralized technologies to evade traditional mitigation strategies. Organizations should prioritize securing IoT devices by enforcing strong authentication policies, regularly updating firmware, and disabling unused network protocols like UPnP. Furthermore, collaboration between public and private sectors remains essential for tracking emerging botnet variants and sharing threat intelligence to stay ahead of adaptive adversaries.

TL;DR

• Dysphoria IoT僵尸网络在JackSkid基础设施被执法部门打击后，转向使用区块链名称服务（ENS/SNS）作为命令与控制（C2）通道，并引入受害者中继节点以增强抗干扰能力。
• 该僵尸网络通过弱密码猜测和已知IoT漏洞传播，规模宣称超20万台设备，但缺乏独立验证；其架构设计使传统服务器 seizure 策略失效。
• 技术演进包括RC4加密、ENS/SNS解析、UPnP端口映射及Linux epoll中继机制，显示攻击者快速迭代与模块化开发能力。
• 区块链C2虽提升隐蔽性，但仍依赖可访问的分布节点和中继设备，未完全脱离中心化依赖，存在潜在攻击面。
• 行业应强化IoT设备默认凭证管理、固件更新机制及网络边界防护，同时关注跨僵尸网络共享工具链带来的协同威胁风险。

为什么值得看

本文揭示了现代IoT僵尸网络如何利用去中心化技术（如区块链命名服务）规避传统反制手段，对网络安全从业者理解新型C2架构与防御挑战具有重要参考价值。同时，其暴露的弱口令滥用与漏洞利用模式，为制定IoT安全基线提供了实证依据。

技术解析

• 区块链C2迁移：Dysphoria在JackSkid被破坏后迅速切换至Ethereum Name Service (ENS)和Solana Name Service (SNS)，将控制指令编码于域名记录中（如burberry[.]eth），实现动态、难封锁的命令下发路径。
• 中继架构设计：采用“感染设备→分布节点→真实控制器”的多层中继模型，DDoS样本先向HTTP分布节点请求最新服务器列表，再由受害机器转发流量至最终C2，隐藏真实控制端IP。
• 快速版本迭代：从4月底的RC4加密+ENS解析，到5月初加入SNS支持，6月推出仅含中继功能的变种并集成UPnP穿透NAT，体现高度敏捷的开发流程。
• 传播机制：主要依靠Telnet/SSH暴力破解及已知远程代码执行漏洞（如CVE-2025-9528 Linksys E1700注入缺陷）进行横向移动，覆盖路由器、网关、摄像头等设备。
• 数据局限性：报告称全球活跃设备峰值达23.9万，但未公开去重方法或采样策略，且无第三方复现，数字应视为估算而非精确统计。

行业启示

• IoT安全治理需前置：厂商应在产品生命周期内强制实施唯一默认密码、定期安全补丁推送及关闭非必要远程功能（如UPnP），从源头减少僵尸网络入侵面。
• 对抗新型C2需升级监测体系：传统基于IP黑名单的阻断方式对区块链驱动的中继网络无效，建议结合DNS查询行为分析、异常流量聚类及链上地址追踪构建多维检测框架。
• 跨组织威胁情报共享至关重要：多国实验室（CNCERT、XLab、NICT、Comcast等）发现代码重叠现象表明攻击工具链存在共用生态，推动建立跨国IoT恶意软件特征库与响应协作机制可有效遏制蔓延。