Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese

The article reports that the Dysphoria IoT botnet, descended from JackSkid, has shifted to blockchain-based command-and-control (ENS/SNS) and now turns some infected devices into relay/proxy nodes, significantly complicating infrastructure takedowns and traditional network blocking.[2][4][5][7] It reportedly controls around 200,000 IoT devices used for DDoS and traffic relay, with infrastructure information hidden in blockchain name records and obfuscated IPv6 strings.[1][3][4][5] From a RealGround perspective, this evolution increases AI supply chain exposure for organizations whose AI agents depend on cloud APIs, gaming platforms, or IoT backends that can be disrupted or abused by resilient botnets; security teams need SBOM-level visibility into IoT and network components, plus continuous red teaming to test how AI-driven workflows behave under DDoS, relaying, or traffic manipulation conditions.[5][9][10] Practically, defenders should harden IoT fleets (closing remote management, eliminating default credentials, updating firmware) and monitor for unusual outbound traffic and ENS/SNS lookups, while factoring such hard-to-takedown botnets into resilience planning for AI