Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria

This report is jointly published by the CNCERT and XLAB.

Since Q1 2026, XLab has been continuously tracking an emerging botnet family named Dysphoria whose bot population exceeds 200,000. Within just a few months this family has gone through frequent variant updates and technical iterations, demonstrating remarkable staying power. Its evolutionary path not only spans the jackskid and fbot variants, but has also recently introduced a covert C2 resolution mechanism based on blockchain ENS/SNS domain names, and has even begun turning victim hosts into C2 relay/proxy nodes. The use of ENS/SNS domains together with relay/proxy nodes makes it considerably harder for defenders to take Dysphoria down.

This article provides an in-depth analysis of Dysphoria's historical evolution timeline, its core string decryption algorithm, its C2 infrastructure retrieval mechanism, as well as its distinctive network proxy mechanism, sample propagation methods, infection scope, and DDoS attacks.

I. Family Evolution Timeline

The Dysphoria family iterates at an extremely rapid pace. From the initial asset correlation to the later hybrid topology architecture, the key milestones are as follows:

• March 25 : Captured a jackskid variant. Through the ENS domain m3rnbvs5d.eth, it was correlated with Telegram channel information. The sample outputs the distinctive string android has no compatible libc library.

• April 1 : Captured an fbot variant. Upon successful execution, it outputs hail china mainland\x00.

• April 29 – April 30 : Introduced an entirely new RC4-based string encryption algorithm and C2 acquisition mechanism. The variant began heavily reusing design philosophies from jackskid and activated the ENS domain ukranianhorseriding.eth.

• Early May : Introduced Solana-based SNS domain 24carnforth2merseyside.sol for the first time, leveraging TXT records to distribute assets.

• June 10 : Activated a new ENS domain burrberry.eth.

• June 25 : A key turning point. Captured an independent functional variant This sample no longer possesses DDoS attack capabilities and operates purely as a relay/proxy node, marking the beginning of the family's "relay transformation" process.

• June 27 – 28 : Introduced automated UPnP port mapping to enhance NAT traversal capabilities. Simultaneously, it constructed a hybrid C2 chain consisting of "DDoS samples + a dynamic list of C2 relay nodes."

II. DDoS Sample Analysis

Dysphoria samples captured in the wild are primarily categorized into two types: DDoS attack samples and pure relay/proxy samples. A common characteristic shared by both is that at runtime, they tamper with their process name to masquerade as libdalvikengine.so.

1. Modified RC4 Decryption

The latest fbot variant of Dysphoria invests considerable effort in string protection. Its decryption algorithm draws inspiration to some extent from the jackskid codebase:

1. KSA Phase 1: Standard RC4 initialization.
2. KSA Phase 2: Introduces a Linear Congruential Generator (LCG) algorithm to shuffle the S-box five consecutive times.
3. PRGA Phase: Incorporates Linear Feedback Shift Register (LFSR) stepping during keystream generation, along with complex bit-shift and swap operations.

The following is the complete Python reproduction of the algorithm:

KEY = (
    0x08, 0x45, 0x3C, 0xD1, F9, 0x5D, 0x5C, 0x27,
    0x61, 0x21, 0x1C, 0xBD, E3, 0x0F, 0x3B, 0x9C,
)

def decrypt(data: bytes) -> bytes:
    s = list(range(256))

    # KSA Phase 1
    j = 0
    for i in range(256):
        j = (j + s[i] + KEY[i & 15]) & 0xff
        s[i], s[j] = s[j], s[i]

    # KSA Phase 2: LCG-based obfuscation
    lcg = 0xE0A4CBD6
    for _ in range(5):
        for i in range(256):
            lcg = (lcg * 0x41C64E6D + 12345) & 0xffffffff
            r = (lcg >> 16) & 0xff
            s[i], s[r] = s[r], s[i]

    out = bytearray(data)

    # PRGA: LFSR integration with multi-swap
    i, j, k = 0, 0, 0
    lfsr = 0xF31C8B2E

    for p in range(len(out)):
        i = (i + 1) & 255
        si = s[i]
        j = (j + si) & 255
        sj = s[j]

        # Swap 1
        s[i], s[j] = sj, si

        # Swap 2
        k = (k + sj) & 255
        tmp = s[k]
        s[k] = si
        s[j] = tmp

        idx = (tmp + si + sj) & 255

        # LFSR step
        if lfsr & 1:
            lfsr = ((lfsr >> 1) ^ 0xD800A4) & 0xffffffff
        else:
            lfsr >>= 1

        x = s[idx] ^ (lfsr & 0xff)
        ks = ((x << 3) | (x >> 5)) & 0xff
        ks ^= x >> 4

        out[p] ^= ks

    return bytes(out)

2. Blockchain Domain-Based Covert C2 Resolution Mechanism

Dysphoria supports both ENS (Ethereum Name Service) and SNS (Solana Name Service). It queries the specific custom records of these domains. The key mapping relationships for different domains are as follows:

Spoofed IPv6 Address Obfuscation

After extracting the records, the text contains spoofed IPv6 addresses delimited by | (e.g., 2001:db8:12e7:13d7::1). The sample performs byte-by-byte string comparison to filter and extract the critical 4-byte data, which is then passed through a custom permutation function F to recover the actual IPv4 address (144.31.38.215):

def ror8(x, r):
    return ((x >> r) | (x << (8-r))) & 0xFF

def F(x, i, key=0x80408454):
    x = ((x >> 4) | (x << 4)) & 0xFF
    x = ror8(x, i+1)
    k = (key >> (24 - 8*i)) & 0xFF
    return ((x ^ k) + k) & 0xFF

def decode_ip(ip_bytes):
    k = 0x80408454
    return ".".join(str(F(ip_bytes[i], i, k)) for i in range(4))

# Example: extracting the critical 4 bytes (corresponding to 12e7:13d7)
ip_bytes = bytearray.fromhex("12e713d7")
print(f"Decoded IP: {decode_ip(ip_bytes)}")

Dynamic C2 Acquisition Workflow

The dynamic load-balancing mechanism introduced in late June is highly deceptive:

1. The DDoS sample first resolves the node record of burrberry.eth and decrypts a set of relay distribution node IPs (e.g., 144.31.38.215).
2. The DDoS sample then sends HTTP GET requests to these distribution nodes: http://<node_ip>:9000/nodes?key=meowmeowmeow.
3. The IP list returned by this endpoint is used by the DDoS sample as the actual C2 interaction addresses. However, during actual tracking and investigation, it was discovered that all returned C2 addresses are in fact relay nodes converted from other compromised hosts.

Active C2 (including relay) trend:

3. Network Protocol and Command Structure

Building upon fbot, Dysphoria has redesigned its underlying communication protocol. Both the registration packet and the heartbeat packet are fixed at 78 bytes.

Registration Packet (Login) and Heartbeat Packet Structure

+-----------------------------------------------------------------------+
|                  Dysphoria Communication Packet Structure             |
+-----------------------------------------------------------------------+
| Login Packet (78 Bytes):                                              |
| [0----1] [2---------13] [14----15] [16-----------15+len] [Padding]    |
| Type(2B)   Magic(12B)    Length     Value (dynamic length)  Padding   |
+-----------------------------------------------------------------------+
| Heartbeat Packet (78 Bytes):                                          |
| [0----1] [2---------13] [14--------------------------------------77]  |
| Type(2B)   Magic(12B)                    Padding                      |
+-----------------------------------------------------------------------+

• Login Magic: 00 80 00 5a 00 57 00 c8 00 f0 00 1e (MsgType: 02 00)
• Heartbeat Magic: 22 ba 15 24 1a 6f 04 d4 1f 9c 0d 06 (MsgType: 00 00)

DDoS Attack Command Structure

The attack command employs a multi-stream nested structure, which also includes a flag structure for parameter control:

+---------------------------------------------------------------------------------------+
| Duration | AtkType | TargetCnt | targets[TargetCnt] | FlagCnt | flags[FlagCnt]        |
|  (2B)    |  (1B)   |   (1B)    | (dynamic nested)   |  (1B)   | (dynamic nested)      |
+---------------------------------------------------------------------------------------+

Where:
1. Target structure:
+-----------------------+
| IP (4B) | Netmask (1B)|
+-----------------------+

2. Flag structure (key addition in this update):
+------------------------------------------+
| Option (1B) | Length (2B) | Value [Len]  |
+------------------------------------------+

III. Relay/Proxy Sample Analysis

A new standalone variant that emerged in late June (e.g., b0782a9...) has a highly focused purpose: it strips away all DDoS attack modules and solely functions to transform compromised internal-network hosts into covert network relay stations for cybercriminal operations.

1. Automated UPnP NAT Traversal

Since the majority of IoT devices and personal PCs reside behind NAT, they cannot be directly reached from the outside. Upon startup, the relay sample broadcasts within the local area network to discover gateway devices that support UPnP (Universal Plug and Play). It then forcibly invokes the WAN connection service to instantly map 155 ports on the router via stream-based port forwarding.

2. Bidirectional Non-Blocking High-Performance Relay (Epoll)

Once the compromised host successfully listens on these 155 ports, any inbound external traffic (e.g., from attackers or front-end requests from DDoS samples) arriving at a given port bot:P triggers the relay sample to:

1. Immediately initiate an outbound connection to the actual remote c2:P (on the same port).
2. At the underlying layer, leverage Linux's high-performance epoll-based asynchronous non-blocking I/O to bind the two connections together, implementing a bidirectional non-blocking transparent data relay.

3. Relay Status Reporting

At intervals of more than 4 seconds, each relay node sends a JSON-formatted health status report to the heartbeat collection domain login.trees4sale.net:9000, reporting its availability:

{
  "status": "ONLINE",
  "connections": 42,
  "bandwidth_mbps": 12.5
}

IV. Sample Propagation

Dysphoria samples primarily propagate through Telnet/SSH brute-force attacks using weak credentials and known Remote Code Execution (RCE) vulnerabilities in IoT devices. The attack targets encompass routers, gateways, IP cameras, and other embedded Linux devices. The following is a partial list of exploited vulnerabilities observed:

CNVD-2021-79445
CVE-2013-3307
CVE-2016-20016
CVE-2017-17215
CVE-2017-5259
CVE-2025-9528
CVE-2018-14558
CVE-2020-25499
CVE-2020-8515
CVE-2025-28137
CVE-2025-34152
CVE-2025-55182
CVE-2022-35733

This list includes both classic IoT vulnerabilities that have been widely exploited by botnets for years (e.g., CVE-2017-17215, CVE-2020-8515) and recently disclosed new vulnerabilities, indicating that Dysphoria continues to actively maintain and update its propagation capabilities to expand coverage across different brands and models of IoT devices. Meanwhile, Telnet/SSH weak-credential brute-force attacks remain its primary and most stable infection vector, working in conjunction with vulnerability exploitation to form its main propagation channels.

V. Infection Scope and Scale

Monitoring and analysis revealed that during the period of July 14–20, 2026, the Dysphoria botnet had a confirmed active compromised host ("bot") population of 4,401 within mainland China. Daily online domestic bot count peaked at 1,801, and the daily peak C2 access volume reached 740,000 requests. Because the botnet leverages compromised hosts as C2 relays, the observed scale of overseas bots is considerably larger, with the daily online overseas bot count peaked at 239,000. The daily domestic bot online trend is illustrated below:

According to leaked C2 panel screenshots on social media, the bot population controlled by Dysphoria has been consistently maintained at approximately 200,000. This figure closely matches our monitoring data, lending credibility to the screenshots and confirming Dysphoria's significant botnet scale.

Furthermore, Dysphoria's promotional page claims up to 4 Tbps of DDoS capacity and offers tiered attack packages priced from tens to hundreds of dollars based on duration and bandwidth — a sign of a fairly mature commercial operation.

VI. DDoS Attacks

In terms of DDoS attacks, Dysphoria's targets are distributed globally, spanning multiple industries including internet services and gaming. The victim profile is characterized by broad geographic distribution and wide industry coverage. Continuous monitoring indicates that attack activities occur on an almost daily basis, maintaining a consistently high level of activity. The attack target trend is shown below:

VII. Threat Intelligence (IOCs)

1. Download/C2 Servers (Including Distinctive FTP Banner)

Banner Signature: 220 cool ftp server hosted on brian krebs' giant ass 4head

• 217.60.195.160
• 76.164.203.171
• 92.42.100.131
• 78.153.155.152

2. Infrastructure Domains

• i.peer4you.net
• o.peer4you.net
• login.trees4sale.net
• www.trees4sale.net
• c2.saintpetersburgresident.ru
• peer.saintpetersburgresident.ru
• kieron.androiddebugbridge.su
• dysphoria.androiddebugbridge.su
• telaviv.androiddebugbridge.su
• jerusalem.androiddebugbridge.su
• node.androiddebugbridge.su
• wow.androiddebugbridge.su

3. Blockchain Domains

• m3rnbvs5d.eth (ENS)
• burrberry.eth (ENS)
• ukranianhorseriding.eth (ENS)
• 24carnforth2merseyside.sol (SNS)

4. Sample Hashes (SHA1)

• c1bedea261f325441fb9a75c50b11d0c8fb01ac6
• a3b9575897c16cbf6afe3af1aa8b55171ea6edf9
• 8db6c78533c176f13b61405cdc3f8fad703325f1
• 9c1716d770ea69e8e1418d96d52222396ecb4362
• 73651c02b29f1c07e3177e86c967fc45e9f30f0f
• 955ff909972958098f0d4a06bcc4d6b9eea90449
• 25081bdec05f64eb4f313420c82d8de957e30026
• dcea71b9ab9de8efca301de9e2f7bf11c7132364
• df510f6f69a5c149c216c7b3accc4f460d8cf363
• b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be
• e7e1694162639ed587625432a79cfaa49f560d11
• b7faa44ab0772047a8581bbfdd9c561e28fc66de