Dysphoria Botnet Leverages Ethereum & Solana Domains to Obfuscate C2 for 200 K Infected Devices
What Happened — Researchers from QiAnXin XLab and China’s CNCERT disclosed a botnet of roughly 200,000 compromised devices that resolves command‑and‑control (C2) servers through Ethereum Name Service (ENS) and Solana Name Service (SNS) domains. The malware encrypts the real IP addresses inside TXT records using a custom‑modified RC4 scheme, keeping the true C2 endpoints invisible to traditional DNS monitoring.
Why It Matters for Compliance & Audit Readiness
- The technique sidesteps conventional network‑traffic logging, making it harder to produce defensible evidence of malicious activity during a SOC 2 audit.
- Continuous‑control monitoring must include verification that DNS and blockchain‑based name resolutions are scoped, logged, and correlated with asset inventories.
- Mapping this novel C2 channel to the CC6.1 – System and Communications Protection control set demonstrates due‑diligence and strengthens the audit trail.
Who Is Affected — Any organization with internet‑connected endpoints (e.g., enterprise IT, OT, SaaS providers, cloud‑hosted workloads) is a potential target; the botnet’s reach spans multiple sectors, including finance, healthcare, and manufacturing.
Recommended Actions
- Extend DNS logging to capture ENS/SNS TXT queries and correlate them with known good domain lists.
- Incorporate blockchain‑domain resolution checks into your continuous‑compliance platform to flag anomalous lookups.
- Map the detection of such C2 activity to SOC 2 CC6.1 and retain the logs as audit evidence.
Technical Notes – The botnet evolved from the jackskid and fbot families, adding a multi‑chain blockchain C2 resolution layer and a heavily modified RC4 encryption (LCG‑shuffled S‑box + LFSR‑augmented keystream). Sample ENS domains: burrberry.eth, ukranianhorseriding.eth; Solana domain: 24carnforth2merseyside.sol. Source: SecurityAffairs