Dominic Jainy is a seasoned IT professional who stands at the intersection of emerging technologies and cybersecurity. With a career rooted in artificial intelligence, machine learning, and the intricacies of blockchain, he has spent years analyzing how decentralized systems can be leveraged for both innovation and exploitation. His recent work focuses on the evolution of Internet of Things (IoT) threats, specifically how botnets are pivoting away from traditional command structures to become virtually indestructible through distributed ledger technology. By examining the transition from the disrupted JackSkid infrastructure to the sophisticated Dysphoria lineage, Jainy provides a masterclass in modern digital warfare and the resilience of cyber-criminal ecosystems.
The following discussion explores the tactical shift of the Dysphoria botnet toward blockchain-based command-and-control resolution and the use of victimized devices as relays. We delve into the metrics of its massive scale, the specific vulnerabilities being exploited in consumer hardware, and why traditional law enforcement takedowns are becoming increasingly difficult to sustain in a decentralized world.
How has the landscape for IoT botnets evolved following the major law enforcement operations we saw in March, and what does the emergence of Dysphoria tell us about the resilience of these criminal networks?
The events of March 19 were supposed to be a crushing blow, a coordinated strike by the U.S., Germany, and Canada against four major IoT botnet infrastructures. When the dust settled, court documents revealed that one of those targets, JackSkid, had been responsible for orchestrating more than 90,000 DDoS commands, yet the victory was surprisingly short-lived. Just six days later, on March 25, we began seeing the first samples of what is now called Dysphoria, which essentially salvaged the wreckage of JackSkid and rebuilt it with a much harder shell. This quick turnaround proves that these operators aren’t just script kiddies; they are resilient engineers who treat law enforcement disruptions like a routine software update or a forced migration. By shifting to a decentralized model almost immediately, they’ve shown that the old “hub-and-spoke” botnet model is dying, replaced by something that doesn’t have a single heart you can stop.
The adoption of Ethereum and Solana name services represents a significant shift in how these botnets operate. Can you explain the technical advantage of using blockchain for command-and-control resolution?
Integrating the Ethereum Name Service (ENS) and Solana Name Service (SNS) is a brilliant, albeit malicious, use of modern tech to bypass the traditional “kill switch” that defenders rely on. In a standard botnet, law enforcement can seize a domain by going to a registrar, but with domains like m3rnbvs5d[.]eth or burrberry[.]eth, there is no central authority to serve a warrant to. I’ve watched the timeline of this build—the April updates introduced custom RC4 string encryption and ENS resolution, followed swiftly by Solana integration in early May. By using these blockchains to encode distribution-node IPv4 addresses, the botnet ensures its instructions are always reachable as long as the blockchain exists. It creates a permanent, immutable record for the bots to find their masters, making the conventional server seizure almost entirely obsolete in the face of decentralized ledger technology.
Beyond just the blockchain element, Dysphoria utilizes infected devices as relays. How does this multi-layered architecture protect the actual controllers from detection?
The architecture of Dysphoria is designed specifically to keep the real controllers in the shadows, using its own victims as a human shield of sorts. On June 25, a relay-only variant emerged that was particularly interesting because it dropped its DDoS modules entirely to focus on shuttling traffic through Linux epoll and UPnP-based port mapping. This allows the botnet to traverse NAT gateways and turn a home router or a camera into a middleman that hides the true origin of a command. When a bot asks a distribution node for a server list, it’s actually getting a list of other infected machines that are relaying the traffic to the actual command-and-control service. It’s a sophisticated shell game where, even if a defender identifies a source of malicious traffic, they are only looking at another compromised victim rather than the operator’s infrastructure.
With reports suggesting a population of over 200,000 bots, what are the primary methods of infection, and why are we still seeing such success with relatively simple attack vectors?
The sheer scale of this is staggering, with telemetry showing a peak of 239,000 bots abroad on a single day and thousands of active devices being logged within specific regions like China between July 14 and 20. Despite the high-tech blockchain back-end, the “front door” for these infections remains frustratingly simple: weak Telnet and SSH credentials. We are still seeing the same password-guessing techniques that have worked for decades because users and manufacturers still aren’t prioritizing basic security hygiene. However, they aren’t ignoring more technical gaps either; they’ve integrated exploits for vulnerabilities like CVE-2025-9528, a command-injection flaw in Linksys E1700 routers. It’s a dual-threat approach where they use the low-hanging fruit of weak passwords to build volume while utilizing public exploits to target specific hardware that hasn’t been patched.
While the operators claim to launch massive attacks, there is often a gap between their advertisements and reality. How should we interpret the reported power of these botnets versus what is actually observed on the ground?
There is definitely a bit of “marketing” involved in the dark-web storefronts, where operators claim to offer attacks of up to 4 Tbps for just a few hundred dollars. We have to take those claims with a grain of salt, especially since no independent source has confirmed a Dysphoria attack at that specific peak. However, we shouldn’t be complacent, because related lineages like AISURU and Kimwolf were measured by Cloudflare delivering a massive 31.4 Tbps attack prior to the March disruptions. Even if the current measured activity doesn’t always hit those astronomical numbers, the 200,000-device scale provides enough raw power to disrupt almost any internet service or gaming target. The danger isn’t just in a single record-breaking attack, but in the daily, persistent strikes that Dysphoria carries out against targets globally.
What is your forecast for the future of decentralized botnets as they continue to integrate these more complex technologies?
I anticipate that the “blockchain-as-a-service” model for botnets will become the industry standard for cyber-criminals, leading to a world where botnets are virtually immortal. We will see more “relay mesh” designs that make the internet’s own infrastructure a weapon against itself, where the distinction between a victim and a participant becomes increasingly blurred. As long as we have over 200,000 unpatched or weakly secured devices sitting on the edge of our networks, these decentralized systems will have plenty of fuel to grow. My fear is that as these networks become more autonomous and self-healing, our window for manual intervention will close, leaving us reliant on automated AI defenders to fight a war that is happening at a speed and complexity we can no longer manage by hand.