Malik Haidar is a veteran in the cybersecurity world, known for his deep dives into the mechanics of botnet orchestration and his ability to see the business logic behind malicious code. With years of experience protecting multinational corporations from state-sponsored and criminal threats, he has become a leading voice on the intersection of infrastructure security and emerging technologies. Today, he breaks down the emergence of Dysphoria, a sophisticated IoT botnet that has weaponized blockchain technology and hijacked hundreds of thousands of devices to create a massive, resilient infrastructure for hire. We discuss the shift from static command servers to decentralized name services, the clever obfuscation of IP addresses, and how this network transforms ordinary home routers into stealthy proxies.
Our conversation explores the technical evolution of the Dysphoria family, from its early jackskid and fbot roots to its current hybrid architecture. We examine the mechanics of its blockchain-based command-and-control system, which utilizes Ethereum and Solana domains to evade traditional takedown methods. The interview also touches upon the specific vulnerabilities exploited to build this 200,000-strong bot army, the sophisticated encryption routines protecting its communications, and the commercial DDoS-for-hire model that powers its operators’ profits. Finally, we look at the practical steps organizations must take to identify these silent infections within their own networks.
When command-and-control infrastructure shifts to blockchain domains like Ethereum Name Service or Solana, what does this mean for the traditional playbook used by security teams to dismantle botnets?
The shift to blockchain-based domains like Ethereum Name Service (ENS) and Solana Name Service (SNS) essentially breaks the standard incident response loop we have relied on for decades. In a traditional setup, when we identify a malicious command-and-control (C2) server, we can work with registrars or hosting providers to seize the domain or sinkhole the traffic. With Dysphoria, the operators use domains like burrberry.eth and ukranianhorseriding.eth, which exist on a decentralized ledger where there is no central authority to serve a takedown notice to. The botnet pulls its instructions from TXT records—such as those labeled “node” or “network”—which sit entirely outside the reach of conventional law enforcement or security provider intervention. This creates a permanent, unchangeable redirection point that ensures the 200,000 infected devices can always find their masters, making the infrastructure incredibly resilient to the kind of disruptions that typically end a botnet’s lifecycle.
The technical analysis of Dysphoria reveals a clever way of hiding active command endpoints within blockchain records—could you explain how the operators use IPv6 lookalikes to deceive analysts?
The brilliance, or rather the cunning, of Dysphoria lies in its data obfuscation within these blockchain records. When a researcher or an automated scanner looks at a domain like 24carnforth2merseyside.sol, they don’t see a list of obvious IP addresses; instead, they find strings formatted to look exactly like dead or inactive IPv6 addresses. For example, a sample string like 12e7:13d7 appears to be a standard network address, but it is actually a scrambled payload. The malware uses a specific permutation function that involves bit rotation and XOR operations against a fixed key to decode these strings into active IPv4 addresses, such as 144.31.38.215. By embedding the actual C2 targets across specific byte segments and disguising them as legitimate network traffic, the operators ensure that casual observation or basic signature-based detection will miss the active command endpoint entirely.
Looking at the development timeline since March 2026, how has the botnet’s architecture changed to become more resilient and versatile in its operations?
The evolution of Dysphoria has been remarkably rapid, moving from a single malware lineage to a complex, multi-functional network in just a few months. It started in late March with jackskid-based samples, but by early April, the fbot variant had already taken over, showing a willingness to iterate on code quickly. By May, they had added Solana support and sophisticated RC4-based string encryption, but the real turning point was in late June when the family split its functions into two distinct roles. They moved away from a simple attack tool toward a hybrid C2 structure that utilizes both DDoS-capable variants and specialized relay nodes. This modularity allows the operators to protect their core infrastructure while using compromised devices to mask the origin of their attacks, creating a layered defense that is much harder for us to map and neutralize.
The introduction of a relay-only variant seems to represent a pivot toward turning infected devices into proxy infrastructure—how does the botnet manage to bypass home network protections to achieve this?
The relay-only variant is particularly insidious because its sole purpose is to convert an ordinary device sitting behind a firewall or Network Address Translation (NAT) into a usable gateway for the attackers. Most home and office routers naturally block inbound connections, but Dysphoria uses Universal Plug and Play (UPnP) to essentially ask the router to open a door from the inside. Specifically, the malware calls the WAN connection service to automatically map port 155, allowing external traffic to flow directly to the compromised device. Once that port is live, it uses Linux’s epoll asynchronous I/O to bind inbound connections from the attacker to outbound connections toward the target. This allows traffic to move in both directions without the need for heavy buffering, making the infected device a high-speed, silent proxy that reports its status back to a heartbeat domain like login.trees4sale.net every four seconds.
While many modern threats focus on Zero-Days, Dysphoria seems to rely on a mix of old and new vulnerabilities—what does this tell us about the current state of IoT security?
Dysphoria’s success highlights a massive gap in how we maintain the “edge” of our networks, as it exploits a library of vulnerabilities spanning nearly a decade. While it does incorporate recent disclosures from 2025, such as CVE-2025-9528 and CVE-2025-55182, it continues to find massive success with older flaws like CVE-2017-17215. This tells us that even as new exploits are integrated, the most consistent entry point remains the simplest: weak-password brute-forcing on Telnet and SSH services. The fact that a botnet can still amass 200,000 bots using techniques we have known about for years is a sobering reminder that the “set and forget” mentality of IoT deployment is a gift to attackers. It demonstrates that propagation code isn’t just about finding the newest hole; it’s about having a wide enough net to catch the millions of devices that are never patched.
With peaks of over 200,000 active bots and a capacity for 4 Tbps attacks, how does the commercial model for Dysphoria impact the broader landscape of internet stability?
The scale of Dysphoria is truly staggering when you look at the raw numbers, especially considering it can generate up to 4 Tbps of attack capacity. During peak monitoring periods, researchers saw as many as 239,000 bots online in a single day, facilitating over 740,000 C2 sessions on the busiest days. This isn’t just a technical achievement; it’s a highly profitable business where DDoS packages are sold on public pages for anywhere from tens to hundreds of dollars. By lowering the cost of entry for massive-scale attacks, the operators of Dysphoria enable a constant stream of disruption against internet services and gaming companies globally. The hybrid relay model further complicates this because it inflates the apparent footprint of the attack, making it seem as though the traffic is coming from a diverse set of legitimate home and business users rather than a centralized botnet.
What is your forecast for the future of botnets that leverage decentralized web technologies?
I expect we will see a significant surge in “unstoppable” botnets as more operators realize that blockchain domains are the ultimate shield against traditional cybersecurity efforts. We are entering an era where the command structure of a botnet is as permanent as a financial transaction on a ledger, and the use of relay-only nodes will make the source of these attacks increasingly invisible. As these networks continue to move away from hardcoded IPs and toward these decentralized name services, our focus must shift from attempting to take down the infrastructure to detecting the subtle behaviors on the endpoint, like unexpected UPnP port-mappings or the specific 78-byte heartbeat packets used by Dysphoria. The battle is moving from the registrar’s office to the deep packet inspection level, where the only way to win is to out-pace the malware’s own evolution.
