{"id":241662,"date":"2026-07-28T04:18:47","date_gmt":"2026-07-28T09:18:47","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/07\/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide"},"modified":"2026-07-28T04:18:47","modified_gmt":"2026-07-28T09:18:47","slug":"new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/07\/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide","title":{"rendered":"New Dysphoria DDoS botnet spreads to 200k devices worldwide"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide.jpg\"><\/a><\/p>\n<p>A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations.<\/p>\n<p>According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the \u2018<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/aisuru-kimwolf-jackskid-and-mossad-botnets-disrupted-in-joint-action\/\" rel=\"nofollow noopener\" target=\"_blank\">jackskid<\/a>\u2019 and \u2018<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-botnet-hides-in-blockchain-dns-mist-and-removes-cryptominer\/\" rel=\"nofollow noopener\" target=\"_blank\">fbot<\/a>\u2019 malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism.<\/p>\n<p>Specifically, the botnet uses Ethereum ENS and Solana SNS domains to retrieve infrastructure information, while C2 addresses are concealed inside fake IPv6 strings and recovered using a custom byte-transformation algorithm.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. According to QiAnXin XLab cybersecurity researchers, Dysphoria evolved from the \u2018jackskid\u2019 and \u2018fbot\u2019 malware by adding a covert blockchain-based command-and-control (C2) resolution mechanism. Specifically, the botnet uses Ethereum [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3818,1761,34,41],"tags":[],"class_list":["post-241662","post","type-post","status-publish","format-standard","hentry","category-blockchains","category-cryptocurrencies","category-cybercrime-malcode","category-information-science"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=241662"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241662\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=241662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=241662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=241662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}