Researchers logged a single-day peak of 239,000 Dysphoria bots abroad, according to telemetry reported by CNCERT and XLab.
CNCERT and XLab telemetry and the population headline
CNCERT, China's national computer emergency response team, and XLab, the threat‑intelligence lab of Qi'anxin, published joint telemetry that places Dysphoria's population above 200,000 bots. Their published counts include 4,401 confirmed active devices inside China between July 14 and 20 and a single‑day foreign peak of 239,000 bots.
Those figures are presented as telemetry from the two teams; the researchers published no counting or de‑duplication methodology and none of the counts has been independently reproduced. The published numbers should therefore be treated as reported telemetry rather than a precise device census.
Blockchain-based C2: ENS and SNS domains in the chain
After a March 19 coordinated law‑enforcement action targeting JackSkid and three other IoT botnets, several researchers observed a shift by related malware to blockchain name services for command‑and‑control. Nokia Deepfield and Comcast's threat lab documented a fallback to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, within days of the disruption. XLab's Dysphoria timeline begins with a JackSkid sample captured on March 25 that resolves C2 through the same domain.
XLab reports that specific blockchain records encode infrastructure information: burrberry[.]eth carries distribution‑node IPv4 addresses, while 24carnforth2merseyside[.]sol (a Solana Name Service entry) supplies other infrastructure records. The shift to ENS and SNS resolution is one of the central design changes the researchers attribute to Dysphoria following the March disruption.
Infected relays, UPnP mapping, and the relay‑only variant
XLab found that Dysphoria uses distribution nodes and a relay mesh composed of infected devices to hide the real controllers. A DDoS sample contacts a distribution node over HTTP for a current server list; the listed endpoints are infected machines that relay traffic to the true controllers, keeping those controllers one step removed from addresses exposed to bots.
In late April and early May the malware family added custom RC4 string encryption and ENS, then SNS, resolution. On June 25 XLab observed a relay‑only variant that drops DDoS modules and instead uses UPnP‑based port mapping plus Linux epoll to forward traffic between an outside connection and a remote C2 service. UPnP port mapping was added days after the relay‑only build, enabling traversal of NAT gateways. XLab notes that the approach complicates a conventional server seizure, while also observing that the architecture still depends on blockchain records, reachable distribution nodes, and compromised relays.
Propagation vectors: Telnet, SSH, and CVE‑2025‑9528
XLab and CNCERT say Dysphoria spreads through weak‑password guessing over Telnet and SSH and through a set of known remote‑code‑execution flaws in routers, gateways, and cameras. One example named in both published vulnerability lists is CVE‑2025‑9528, a Linksys E1700 command‑injection flaw disclosed in August 2025 that has a public exploit.
The source material records that the vendor did not respond to the original report. NVD's CVSS vector rates the flaw as requiring high privileges, and neither publication explains how the Linksys flaw fits into Dysphoria's propagation chain. The Hacker News compared the two notices and found that XLab's post and the mirrored CNCERT notice publish different vulnerability lists despite presenting the same joint research; both, however, agree that weak Telnet and SSH credentials remain the most consistent way in.
Attack claims, related botnets, and recommendations for defenders
XLab reports Dysphoria targets internet‑service and gaming targets almost daily, but it names no victims or measured attack peaks. A criminal storefront advertises attacks of up to about 4 Tbps for tens to hundreds of dollars; the researchers treat that as an operator claim rather than a measured result. By contrast, Cloudflare previously measured a 31.4 Tbps attack from the related AISURU/Kimwolf botnet before the March disruption. CNCERT, XLab, and earlier JackSkid research name no single operator for these families.
The researchers offer practical defensive guidance: patch exposed IoT gear; replace devices that can no longer be updated; eliminate default and weak credentials; and disable remote management and UPnP where they are not needed. Those steps are cited directly as the primary mitigations for administrators responsible for routers, gateways, cameras, and other Internet‑connected devices.
What remains concrete in this record is both the adaptability of the malware ecosystem and the persistence of simple operational failures: the botnet's move to blockchain name services and a relay mesh shifts the point of failure, but Dysphoria still relies on blockchain records, reachable distribution nodes, and compromised relays—chokepoints that defenders and investigators can observe and, where possible, interdict. Independent measurement of the botnet's true scale and any confirmed Dysphoria attack peaks remains an open factual question in the materials released so far.
