Dysphoria: Six Days After the Takedown, and Eight Years After the Idea
Summary
On 19 March 2026, authorities in the United States, Canada and Germany disrupted the infrastructure behind the four largest IoT botnets ever documented — Aisuru, Kimwolf, JackSkid and Mossad. More than three million infected devices. More than 316,000 DDoS attack commands, including attacks against IP addresses belonging to the US Department of Defense Information Network. Authorities seized virtual servers, internet domains and other infrastructure.
Six days later, XLab captured the first sample of a new botnet family built directly on JackSkid's code. By the time XLab and CNCERT published their joint report on 25 July 2026, it had more than 200,000 bots.
They named it Dysphoria. What matters is not the scale — 200,000 is far smaller than three million — but the architecture. Dysphoria is engineered to own none of the three things the takedown seized:
No ICANN domains; it uses ENS (Ethereum) and SNS (Solana) blockchain domains instead
No attacker-owned C2 servers; victim devices themselves become the relay nodes
No single-chain dependency; fallback lives across multiple blockchains When the C2 node is the victim's own router, "seizing the C2 infrastructure" stops being a legally meaningful proposition.
Priority action: disable UPnP on edge devices, and check whether any router, camera or IoT device on your network is querying blockchain name resolution services — that is behaviour with essentially no legitimate use case on IoT hardware.
Background: The March 2026 Takedown and What Followed
The 19 March operation was a large coordinated effort. The US Department of Justice led it, alongside law enforcement actions in Canada and Germany targeting the individuals operating the botnets. The private-sector partner list is long: Akamai, AWS, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B — and QiAnXin XLab.
| Botnet | DDoS commands | Characteristics |
|---|---|---|
| Aisuru | 200,000+ | Emerged late 2024; behind a series of record-breaking DDoS attacks |
| JackSkid | 90,000+ | Targeted devices on internal networks; grew via residential proxies; averaged 150,000+ daily victims in early March, peaking at 250,000 on 8 March |
| Kimwolf | 25,000+ | Android variant of Aisuru, seeded from it in October 2025; took over 2 million+ Android TV devices |
| Mossad | 1,000+ | Smaller in scale; averaged 100,000+ daily victims in early March |
On firepower, Aisuru and Kimwolf are tied to the largest DDoS attack ever recorded: 31.4 Tbps and 200 million requests per second, lasting only 35 seconds. Cloudflare characterised the combined maximum attack traffic of the two botnets as equivalent to the combined power of substantial infrastructure.
An intelligence detail worth noting: XLab was both a participant in the cleanup and the first to see what grew back. That gives the Dysphoria report particular weight — it was written by people who watched both ends of the cycle.
Krebs on Security identified an important pattern beforehand: after Synthient publicly disclosed the vulnerability Kimwolf was using to propagate (2 January 2026), Kimwolf's spread slowed noticeably. But several other IoT botnets emerged that effectively copy Kimwolf's spreading methods, competing for the same pool of vulnerable devices. Dysphoria arrived into exactly that competitive environment.
The Blockchain Idea Is Not New — the Scale Is
Before the technical detail, Dysphoria needs placing in history.
On 13 September 2018, 360Netlab published Fbot — a Mirai variant related to Satori, notable for peculiar behaviour: it scanned TCP port 5555 (the ADB service on Android), located and uninstalled the com.ufo.miner cryptomining malware, killed mining processes, then self-destructed. The DDoS module inherited from Mirai remained in the code, but 360Netlab logged no attack commands from its C2.
What makes Fbot memorable eight years on lies elsewhere: its C2 was musl.lib, a domain not registered with ICANN and unresolvable through the traditional DNS system. It resolved through EmerDNS, the blockchain-based DNS of the Emercoin platform. 360Netlab assessed that this choice raised the bar for researchers trying to find and track the botnet, and made sinkholing the C2 domain harder.
That was 2018. Dysphoria does the same thing in 2026, but on ENS and SNS — the name services of Ethereum and Solana, two blockchains with millions of legitimate users. The difference is not the idea but the ecosystem: EmerDNS was a niche; ENS and SNS cannot be blocked without broad collateral impact.
And Dysphoria inherits from Fbot directly. XLab documents an fbot variant within this botnet's own evolutionary line.
An observation of ours, at moderate confidence. 360Netlab's 2018 IOC list for Fbot includes a related C2 domain:
ukrainianhorseriding.com. XLab's 2026 IOC list for Dysphoria includes the ENS domain:ukranianhorseriding.eth. The same unusual phrase, eight years apart, moved from a conventional.comto an Ethereum ENS name; they differ by one letter (ukrainianversusukranian), which could be a typo or deliberate. No source in this material asserts that connection, and we do not infer that the same individual is behind both. But if the observation holds, Dysphoria's lineage may be more than code reuse from Fbot — it may be an operational continuation. Verify independently before using this in formal reporting.
Timeline
| Date | Event |
|---|---|
| 13 Sep 2018 | 360Netlab publishes Fbot — C2 musl.lib resolved via EmerDNS, removes com.ufo.miner |
| Late 2024 | Aisuru emerges |
| Oct 2025 | Kimwolf seeded from Aisuru; spreads via residential proxies |
| Nov–Dec 2025 | Record 31.4 Tbps DDoS attributed to Aisuru/Kimwolf |
| 2 Jan 2026 | Synthient discloses the vulnerability Kimwolf used to propagate |
| 18 Mar 2026 | Nokia Deepfield reports a new Mirai-derived botnet targeting Android TV boxes via ADB |
| 19 Mar 2026 | DOJ and partners disrupt Aisuru, Kimwolf, JackSkid, Mossad |
| 25 Mar 2026 | XLab captures the first Dysphoria sample (jackskid variant, via ENS m3rnbvs5d.eth) |
| 1 Apr 2026 | fbot variant appears |
| 29–30 Apr 2026 | New custom RC4 string encryption; ENS ukranianhorseriding.eth |
| Early May 2026 | First use of Solana SNS: 24carnforth2merseyside.sol |
| 10 Jun 2026 | New ENS domain: burrberry.eth |
| 25 Jun 2026 | Pure relay variant — all DDoS modules stripped, relay only |
| 27–28 Jun 2026 | Automated UPnP added; hybrid "DDoS sample + dynamic relay node list" C2 chain completed |
| 14–20 Jul 2026 | Monitoring window: peak of 239,000 overseas bots online per day |
| 25 Jul 2026 | XLab and CNCERT publish their joint report |
XLab emphasises the iteration speed: from a simple jackskid sample in late March to a complete hybrid architecture by late June — roughly three months, with meaningful upgrades arriving weeks apart.
Technical Analysis
Propagation
Dysphoria spreads primarily through weak-credential brute-forcing over Telnet and SSH and exploitation of known remote code execution flaws in IoT devices — routers, gateways, cameras and other embedded Linux systems. XLab stresses that Telnet/SSH weak-password attacks remain the primary and most stable infection method, with exploitation as a complementary channel.
The CVE list deliberately mixes old and new:
CVE-2013-3307 CVE-2020-8515 CVE-2025-9528
CVE-2016-20016 CVE-2020-25499 CVE-2025-28137
CVE-2017-5259 CVE-2022-35733 CVE-2025-34152
CVE-2017-17215 CNVD-2021-79445 CVE-2025-55182
CVE-2018-14558
It includes classic IoT flaws long exploited by botnets — CVE-2017-17215 (Huawei), CVE-2020-8515 (DrayTek) — alongside recently disclosed ones: CVE-2025-55182 ("React2Shell"), CVE-2025-34152, CVE-2025-28137 (TOTOLINK), CVE-2025-9528 (Linksys). Maintaining both groups indicates the operators continue actively updating propagation capability to broaden coverage across device brands and models.
Disguise and String Protection
Both sample types — DDoS and relay — share one runtime characteristic: they rename their own process to libdalvikengine.so, posing as an Android system library.
For string protection, the latest fbot variant uses a notably modified RC4 algorithm which XLab assesses borrows partly from jackskid's design thinking:
KSA stage 1: standard RC4 initialisation with a 16-byte key
KSA stage 2: a linear congruential generator (LCG) shuffles the S-box a further five rounds
PRGA: a linear feedback shift register (LFSR) step is folded into keystream generation, with two swap operations and complex bit shifts XLab published a full Python reimplementation of the algorithm in the original report — worth taking if your team needs to analyse samples.
Blockchain-Based C2 Resolution
Dysphoria supports both ENS (Ethereum Name Service) and SNS (Solana Name Service). It queries TXT or custom records on these domains, with the following key mapping:
| Type | Domain | Query key | Role |
|---|---|---|---|
| ENS | burrberry.eth |
node |
Retrieve relay distribution node IPs |
| ENS | ukranianhorseriding.eth |
network |
Base network infrastructure |
| SNS | 24carnforth2merseyside.sol |
deserialized |
Base network infrastructure |
The fake IPv6 obfuscation layer. The retrieved record does not contain the real IP in plaintext. It contains a series of fake IPv6 addresses separated by the | character — for example 2001:db8:12e7:13d7::1. The sample performs byte-by-byte string comparison to filter out the four significant bytes, then passes them through a custom permutation function to recover the real IPv4 address.
That function rotates nibbles, rotates right by position, then XORs and adds against a hardcoded 32-bit key. In XLab's worked example, the four bytes from 12e7:13d7 decode to 144.31.38.215.
The result: the attacker's server address appears in plaintext nowhere — not in the malware sample, not in DNS traffic, not in the blockchain record.
The Three-Tier Dynamic C2 Chain
This is the sharpest piece of design, and the reason tracing is so difficult:
The DDoS sample resolves the
noderecord ofburrberry.ethand decrypts a set of distribution node IPs (such as144.31.38.215).It sends an HTTP GET to those nodes at
http://<node_ip>:9000/nodes?key=meowmeowmeow.The returned IP list is used by the sample as its actual C2 addresses. But when XLab traced backwards they found the single most important fact in the report: every one of those "real" C2 addresses is another infected host that has been converted into a relay node.
There is no attacker-owned infrastructure tier left to seize. Bots talk to bots.
Network Protocol
Building on fbot, Dysphoria rewrites its lower-layer communication protocol. Login and heartbeat packets are both a fixed 78 bytes:
Login Packet (78 bytes):
[0---1] [2--------13] [14--15] [16------15+len] [padding]
Type(2B) Magic(12B) Length Value (dynamic) Padding
Heartbeat Packet (78 bytes):
[0---1] [2--------13] [14----------------------------77]
Type(2B) Magic(12B) Padding
Login magic:
00 80 00 5a 00 57 00 c8 00 f0 00 1e— MsgType02 00Heartbeat magic:
22 ba 15 24 1a 6f 04 d4 1f 9c 0d 06— MsgType00 00Attack commands use a multi-level nested structure:Duration(2B) | AtkType(1B) | TargetCnt(1B) | targets[] | FlagCnt(1B) | flags[], where each target holds an IP (4B) and netmask (1B), and each flag holds an Option (1B), Length (2B) and Value.
The fixed 78-byte packet size and the two magic strings are among the few artifacts usable as a network-layer signature.
The Relay Variant: Turning Victims Into Infrastructure
The standalone variant that appeared in late June is functionally pure: it strips out every DDoS attack module and does nothing but convert infected hosts on internal networks into covert relay stations for the operation.
Automated NAT traversal via UPnP. Because most IoT devices and personal computers sit behind NAT, external parties cannot connect directly. On launch, the relay sample broadcasts across the LAN searching for gateway devices supporting UPnP, then invokes the WAN connection service to map 155 ports on the router.
Bidirectional non-blocking relay via epoll. The infected host listens on those 155 ports. When external traffic connects to one of them at bot:P, the relay sample immediately opens an outbound connection to the real remote c2:P (the same port number), then uses Linux's high-performance asynchronous non-blocking epoll I/O to bind the two connections and transparently relay data in both directions.
Status reporting. Every four seconds or so, the relay node sends a JSON health report to the heartbeat collection domain login.trees4sale.net:9000, declaring its own availability:
{
"status": "ONLINE",
"connections": 42,
"bandwidth_mbps": 12.5
}
The bandwidth_mbps field is telling: the node self-reports its available bandwidth. This is the behaviour of a system managing infrastructure capacity, not a botnet merely counting infections.
Scale and Business Model
Trend in active C2 count, including relay nodes (source: XLab).
During the monitoring window from 14 to 20 July 2026, XLab recorded:
4,401 confirmed active bots inside China
A peak of 1,801 domestic bots online per day
A peak of 740,000 daily bot connections to C2
A peak of 239,000 overseas bots online per day That last figure dwarfs the domestic count, and XLab explains why: because Dysphoria uses controlled bots as C2 relays, the overseas bot population is more observable to them.
Daily online bot count within China (source: XLab).
From control panel screenshots leaked on social media, Dysphoria's bot population has held long-term at roughly 200,000. XLab cross-checked that figure against its own continuous monitoring data and found it broadly consistent — good corroboration, and an indication the leaked screenshot is credible.
Leaked Dysphoria control panel screenshot circulating on social media (source: XLab).
On commercialisation, Dysphoria's public promotion page claims a maximum DDoS capacity of roughly 4 Tbps, selling attack packages ranging from tens to hundreds of US dollars depending on duration and bandwidth. XLab assesses this as a comparatively mature commercial operating model.
Commercial operating model and service tiers on the public promotion page (source: XLab).
The 4 Tbps figure needs context: it is far below the 31.4 Tbps record set by Aisuru/Kimwolf. But it remains enough to cause significant disruption to most organisations without large-scale DDoS protection.
Trend in Dysphoria's DDoS attack targets (source: XLab).
On attack activity, Dysphoria's targets span the globe across multiple industries including internet services and gaming. Continuous monitoring shows attack activity occurring nearly every day, sustaining a high overall level of activity.
Indicators of Compromise
Indicators taken from the joint QiAnXin XLab and CNCERT report. Domains are defanged. Re-fang only in controlled environments.
Download / C2 server IPs
217.60.195[.]160
76.164.203[.]171
92.42.100[.]131
78.153.155[.]152
144.31.38[.]215 # distribution node, decoded from the ENS record
These servers also carry a distinctive FTP banner usable as a detection signature. The banner string contains an insult directed at a security journalist and is not reproduced here; see XLab's original report for the full value if you need it to build a rule.
Infrastructure domains
i.peer4you[.]net
o.peer4you[.]net
login.trees4sale[.]net # relay node heartbeat collection, port 9000
www.trees4sale[.]net
c2.saintpetersburgresident[.]ru
peer.saintpetersburgresident[.]ru
kieron.androiddebugbridge[.]su
dysphoria.androiddebugbridge[.]su
telaviv.androiddebugbridge[.]su
jerusalem.androiddebugbridge[.]su
node.androiddebugbridge[.]su
wow.androiddebugbridge[.]su
The
androiddebugbridge[.]sucluster of six subdomains is worth noting — the domain names the ADB protocol directly, the same vector Fbot used to spread in 2018 and that Nokia Deepfield observed again in March 2026.
Blockchain domains
m3rnbvs5d[.]eth # ENS — initial jackskid variant
burrberry[.]eth # ENS — key "node", relay distribution nodes
ukranianhorseriding[.]eth # ENS — key "network"
24carnforth2merseyside[.]sol # SNS — key "deserialized"
Sample hashes (SHA-1)
c1bedea261f325441fb9a75c50b11d0c8fb01ac6 # jackskid variant, 25 March
a3b9575897c16cbf6afe3af1aa8b55171ea6edf9
8db6c78533c176f13b61405cdc3f8fad703325f1
9c1716d770ea69e8e1418d96d52222396ecb4362
73651c02b29f1c07e3177e86c967fc45e9f30f0f
955ff909972958098f0d4a06bcc4d6b9eea90449
25081bdec05f64eb4f313420c82d8de957e30026
dcea71b9ab9de8efca301de9e2f7bf11c7132364
df510f6f69a5c149c216c7b3accc4f460d8cf363
b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be # pure relay variant, 25 June
e7e1694162639ed587625432a79cfaa49f560d11
b7faa44ab0772047a8581bbfdd9c561e28fc66de
Behavioural and network artifacts
# On device
Process name: libdalvikengine.so (both DDoS and relay samples)
155 UPnP port mapping rules created on the gateway
Distinctive string: "android has no compatible libc library" (jackskid variant)
Distinctive string: "hail china mainland" (fbot variant)
# On the network
ENS / SNS resolver queries originating from routers, cameras or IoT devices
Fixed 78-byte TCP packets carrying magic values:
00 80 00 5a 00 57 00 c8 00 f0 00 1e (login, MsgType 02 00)
22 ba 15 24 1a 6f 04 d4 1f 9c 0d 06 (heartbeat, MsgType 00 00)
HTTP GET to <ip>:9000/nodes?key=meowmeowmeow
JSON POST to port 9000 with fields: status / connections / bandwidth_mbps
Pipe-separated IPv6 strings inside blockchain domain TXT records
TCP 23 and 22 scanning (Telnet/SSH brute force) from internal devices
Exploited CVEs
CNVD-2021-79445 CVE-2018-14558 CVE-2025-9528 (Linksys)
CVE-2013-3307 CVE-2020-25499 CVE-2025-28137 (TOTOLINK)
CVE-2016-20016 CVE-2020-8515 (DrayTek) CVE-2025-34152
CVE-2017-17215 (Huawei) CVE-2022-35733 CVE-2025-55182 (React2Shell)
CVE-2017-5259
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Observed in campaign |
|---|---|---|---|
| Initial Access | T1110.001 | Brute Force: Password Guessing | Telnet/SSH weak-credential brute-forcing |
| Initial Access | T1190 | Exploit Public-Facing Application | 13 CVEs across routers, cameras, gateways |
| Initial Access | T1078.001 | Valid Accounts: Default Accounts | Default credentials on IoT devices |
| Execution | T1059.004 | Unix Shell | Shell scripts deploying the payload |
| Defense Evasion | T1036.004 | Masquerading: Masquerade Task or Service | Process renamed to libdalvikengine.so |
| Defense Evasion | T1027 | Obfuscated Files or Information | Modified RC4 with LCG and LFSR |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | String decryption and IP recovery from fake IPv6 |
| Command and Control | T1102 | Web Service | ENS and SNS as dead drop resolvers |
| Command and Control | T1568.003 | Dynamic Resolution: DNS Calculation | Byte permutation recovering IPv4 from fake IPv6 |
| Command and Control | T1008 | Fallback Channels | Multi-chain fallback (Ethereum and Solana) |
| Command and Control | T1090.001 | Proxy: Internal Proxy | Relay nodes inside victim networks |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy | Real C2 addresses are other bots acting as relays |
| Command and Control | T1572 | Protocol Tunneling | Bidirectional epoll relay across 155 ports |
| Command and Control | T1571 | Non-Standard Port | Port 9000 for node distribution and status reporting |
| Command and Control | T1105 | Ingress Tool Transfer | Payload retrieval from distribution servers |
| Impact | T1498 | Network Denial of Service | Commercial DDoS service |
| Impact | T1498.001 | Direct Network Flood | Attack types selected via AtkType |
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | Registration of ENS and SNS domains |
[NEEDS VERIFICATION]— two points to check before building a Navigator layer. First, T1568.003 (DNS Calculation) describes computation from returned DNS values; Dysphoria's mechanism is byte-permutation decoding from a blockchain record — close, but not an exact match. Second, there is no dedicated technique for abusing ENS/SNS as C2 resolution infrastructure — T1102 (Web Service) is the best available placement, but it does not capture the "unseizable" property that is the entire reason the attackers chose this mechanism.
Assessment
Dysphoria is an engineering response, not simply a new botnet.
The DOJ announcement specified that the March takedown targeted virtual servers, internet domains and other infrastructure. Three months later, Dysphoria completed an architecture in which none of those three exist in a seizable form:
Domains: ENS and SNS have no registrar to receive a court order. Records live on a distributed ledger and are updated by blockchain transaction.
C2 servers: the addresses bots actually connect to are other victims' routers and cameras.
Fallback infrastructure: spread across two independent blockchains. When the C2 node is the victim's device, "seizing the C2 infrastructure" means "seizing the routers of hundreds of thousands of households and businesses worldwide". No legal system executes that at scale.
But the takedown deserves fair treatment. It was a genuine success: more than three million devices freed from control, and authorities in Canada and Germany went after the people operating the botnets rather than just the infrastructure. The scale comparison says something too: Dysphoria currently has 200,000 bots and advertises 4 Tbps, against three million devices and 31.4 Tbps for the previous generation. The takedown reset the clock. The problem is that it could not reset the idea.
On the idea not being new. Fbot used blockchain DNS in 2018, and 360Netlab warned precisely what would follow: security systems fail if they only look for traditional DNS names. Eight years on, that warning now applies to a 200,000-device botnet rather than an odd worm that went around deleting cryptominers.
What changed in those eight years is the ecosystem. EmerDNS in 2018 was a niche; blocking it entirely would have affected almost nobody. ENS and SNS in 2026 are not — they have millions of legitimate users and are integrated into mainstream wallets and applications. Blocking them at the enterprise layer is feasible; blocking them at the internet infrastructure layer is not. This is the same logic we have seen with *.workers.dev and other cloud services: the barrier is not technical but collateral.
The cheapest detection point in the whole article: a router, IP camera or DVR issuing queries to a blockchain name resolution service is behaviour with essentially no legitimate use case. IoT devices have no business reason to look up ENS or SNS names. The signal is low-noise, requires no prior knowledge of a malware name, and sits at exactly the chokepoint the entire C2 chain must pass through.
Relevance for Vietnam
The CVE list lands squarely on locally common hardware. TOTOLINK (CVE-2025-28137) and DrayTek (CVE-2020-8515) are both widely deployed across Vietnamese small and medium businesses and households. Huawei HG532 (CVE-2017-17215) was distributed by ISPs to subscribers and remains in circulation. This is not a list aimed at large enterprise infrastructure — it targets what sits in the network cabinet of every small office.
Two configuration habits raise the risk. First, default Telnet and SSH credentials are rarely changed on network hardware in small offices and homes — and XLab confirms this remains the primary infection channel, more reliable than exploitation. Second, UPnP is enabled by default on most consumer routers, and that is exactly the mechanism the relay variant uses to open 155 ports.
The biggest risk is not bandwidth. With an ordinary DDoS botnet, an infected victim's loss is mainly bandwidth and device performance. Dysphoria's relay variant changes that: your device becomes C2 infrastructure serving attacks against other organisations.
The practical consequence for a business: your company's public IP appears in another country's victim logs as attack infrastructure, not as a victim. That carries legal exposure, exposure to provider blocklists, and reputational exposure when international partners run their reviews. For companies delivering services to overseas clients, this belongs in the risk assessment rather than being filed as "a device got infected".
Recommendations
Disable UPnP on edge devices unless there is a clear business need, and audit existing port-mapping rules on routers now — 155 new rules is an unmistakable indicator.
Change default credentials and disable Telnet across all routers, cameras, DVRs and embedded Linux devices; block administrative access from the WAN side.
Monitor ENS/SNS resolver queries originating from IoT network segments — IoT devices have no legitimate reason to look up blockchain domains.
Inventory devices against the CVE list above, prioritising TOTOLINK, DrayTek and ISP-supplied routers; update firmware or replace end-of-support hardware.
Segment IoT away from business networks and restrict outbound traffic from that segment — a compromised device should not be able to open arbitrary connections to the internet.
If compromise is suspected: isolate the device, reflash firmware to the latest clean image rather than simply rebooting, rotate all credentials, and check whether your organisation's public IP has landed on any blocklists.
References
QiAnXin XLab and CNCERT — Emerging botnet Dysphoria: evolution and in-depth technical analysis (25 July 2026) — original report, including the Python RC4 decryption script and IP recovery function
BleepingComputer — New Dysphoria DDoS botnet spreads to 200k devices worldwide (27 July 2026)
BleepingComputer — Aisuru, Kimwolf, JackSkid and Mossad botnets disrupted in joint action (20 March 2026)
BleepingComputer — New Botnet Hides in Blockchain DNS Mist and Removes Cryptominer (17 September 2018)
360Netlab — Fbot, A Satori Related Botnet Using Block-chain DNS System (2018)
Krebs on Security — Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
The Hacker News — DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks
SecurityWeek — Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation
CyberScoop — Justice Department disrupts botnet networks that hijacked 3 million devices
Team Cymru — Team Cymru & DOJ Disrupt World's Largest IoT DDoS Botnets
Security Affairs — Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure
Help Net Security — Authorities disrupt four IoT botnets behind record DDoS attacks
