The shift from centralised to decentralised botnet infrastructure represents a significant evolution in how threat actors maintain command and control over distributed networks. Recent analysis of the Dysphoria IoT botnet shows this pattern clearly: after a March law-enforcement takedown of JackSkid infrastructure, the operators pivoted toward blockchain-based name resolution and victim-relay architectures—making the network materially harder to disrupt through conventional means.
The Centralised Chokepoint Problem
Traditional botnets have relied on centralised command-and-control (C2) servers. Law enforcement understands this weakness well. A single point of failure—a hosting provider, IP block, or domain registrar—can be seized, sinkholed, or blocked wholesale. The JackSkid operation demonstrated the effectiveness of this approach: dismantle the infrastructure, and the botnet fragments.
But this creates pressure for innovation. Threat actors learned decades ago that redundancy matters. Mirror servers, bulletproof hosters, and fast-flux DNS all extended C2 lifespan. Dysphoria's adoption of blockchain services pushes that logic further: instead of trusting a hosting provider or domain registrar to keep the infrastructure online, the botnet uses a distributed ledger that no single entity controls.
Blockchain as an Evasion Layer
The appeal is straightforward. Blockchain-based naming services (analogous to DNS but resident on an immutable ledger) distribute the lookup authority across thousands of nodes. An infected device queries the blockchain to resolve a command endpoint. Even if one resolver node is blocked or monitored, the device can query another. There is no central nameserver to seize, no registrar to pressure into taking the domain down.
Dysphoria's researchers also noted the use of infected-device relays—essentially compromised machines acting as intermediate proxies for C2 traffic. This layering obscures the true location of command infrastructure and distributes the load across victims. An analyst observing traffic from a single infected host sees only local relay activity, not the upstream control server.
These techniques are not novel in isolation. But their combination in a widely distributed IoT botnet signals a maturation in how threat groups think about resilience. The architecture assumes that some nodes will be discovered, disrupted, or sinkholed. Redundancy and decentralisation are built in from the start.
Implications for Network Operators and Hosters
For infrastructure operators, this shift has concrete consequences. Traditional botnet detection—DNS sinkholing, IP blocklisting, or seizing hosting accounts—becomes less effective. A network defender cannot simply block traffic to a known C2 domain or IP range when the C2 location is resolved dynamically via blockchain and routed through victim relays.
Detection must shift upstream: identifying infected devices by their behaviour (communication patterns, payload signatures, anomalous outbound traffic), not by their C2 destinations. This places renewed emphasis on endpoint monitoring, network segmentation, and behavioural analytics.
Hosters and datacenter operators also face a harder problem. Takedown requests and law-enforcement notices are less useful when no single provider hosts the infrastructure. A bulletproof hoster might lose a C2 server, but the botnet continues through blockchain resolution and relay traffic. This does not mean hosting infrastructure is irrelevant—the relays and any supporting infrastructure still exist somewhere—but it does mean that disruption via traditional infrastructure takedown is less certain.
The Broader Pattern
Dysphoria is not an outlier. Researchers tracking the botnet note that this represents an adaptation to enforcement pressure. When one method of command and control fails, threat actors adopt the next. Blockchain and peer-to-peer technologies offer decentralisation and resilience—properties that happen to be valuable for both legitimate privacy advocates and for criminals evading detection.
This convergence is not coincidental. The same technical properties that enable privacy-preserving infrastructure also enable evasion of law enforcement. As mainstream services become more traceable and regulated, underground operations move toward decentralised alternatives. This creates a secondary problem for defenders: technologies designed for privacy and resilience become tools for maintaining botnet infrastructure.
The longer-term lesson is that infrastructure security cannot rely solely on centralised takedowns. As botnets distribute their control mechanisms across blockchain and relay networks, detection and remediation must become more sophisticated, more distributed, and more proactive. The era of simple sinkholing is fading.
