Since the first quarter of 2026, researchers at XLab have been monitoring an IoT botnet family known as Dysphoria This article explores detected fbot variant. . Within just a few months, Dysphoria has undergone multiple variant changes and architectural shifts, showcasing remarkable resilience against law enforcement efforts and industry takedowns.
The family's lineage includes variants inspired by jackskid and fbot-style technologies. On March 25, analysts identified a Jackskid variant linked to the ENS domain m3rnbvs5d.eth, with the sample displaying a unique debug string: "android has no compatible libc library." On April 1, they detected an Fbot variant that executed the command "hail china mainland\x00," indicating a related but distinct strain within the same ecosystem.
Two days later, Dysphoria added automated UPnP port mapping and constructed a hybrid chain consisting of "DDoS samples + dynamic C2 relay lists," solidifying its transition to a relay-driven architecture that significantly complicates takedowns. This LCG shuffles the S-box five times before proceeding to a keystream generation process that includes a Linear Feedback Shift Register (LFSR), multiple swap operations, and bit shifts. For instance, burrberry.eth exposes a node record used to fetch relay distribution IPs, while ukranianhorseriding.eth and 24carnforth2merseyside.sol carry network and deserialized keys for base network infrastructure, as mentioned by qianxin.
By cutting through SOC investigation blind spots and containing threats earlier, ANY.RUN can help reduce response costs and minimize business disruption.
