He Moved His Botnet to the Blockchain So Nobody Could Take It Down. Then He Wrote His Own Confession Into It.

On March 19, US, German, and Canadian law enforcement disrupted the JackSkid botnet. It had been averaging over 150,000 daily victims and peaked at 250,000. More than 90,000 DDoS commands were attributed to it.

Within days, the operator was back — and this time the command-and-control resolution lived on the Ethereum Name Service. CNCERT and XLab at QiAnXin have documented the successor, Dysphoria: a relay-only variant in late June, UPnP NAT traversal added days later, propagation through CVE-2025-9528 in Linksys E1700 routers, and roughly 4 Tbps of DDoS capability.

The interesting part is not the throughput. It is why he moved to the blockchain, and what that choice cost him.

Blockchain C2 is takedown insurance

We have been tracking on-chain dead drops as a standing indicator class since PolinRider (Tron and Aptos), Starland (Polygon), and the AsyncAPI/Miasma compromise (Ethereum). The pattern in every case: a loader reads its next stage — or its C2 address — from a blockchain, because you cannot seize a blockchain.

Dysphoria extends the class in a way worth naming. The dead drop is not a wallet holding encrypted data. It is a name-service record. ENS and Solana Name Service entries hold the infrastructure pointers, and the malware resolves them the way your browser resolves DNS.

That is a meaningful evolution. A domain can be seized by a registrar in an afternoon. An ENS name is a token in a smart contract — there is no registrar to serve, no registry to compel, no hosting provider to email. He watched his infrastructure get dismantled in March and rebuilt it on the one substrate that has no takedown button.

As engineering, it is a rational response to enforcement pressure. We should expect to see much more of it, and defenders should stop treating "the C2 domain was sinkholed" as the end of a campaign.

What we resolved

We pulled the ENS records ourselves rather than take the summaries on faith, and got the controlling addresses — which none of the published reporting includes.

The Dysphoria sales-channel name resolves to one Ethereum address. A second name holding the obfuscated infrastructure records resolves to a different one — and that second address also controls a third ENS name, which links the two dead drops to a single operator. That linkage is the useful part: it means the infrastructure records and the advertising are the same person, and it gives defenders a durable pivot that survives any individual name being abandoned.

All of it — three ENS names, one SNS name, both controlling addresses, and the operator's advertised sales channel — is in our free feed now, tagged manual-batch-dysphoria, confidence 90, verified landed.

The part where we nearly did real damage

The reporting says the name-service records "encode distribution-node IPv4 addresses." They do appear to encode something: thirty entries, each an IPv6 address inside 2001:db8::/32, which is the block RFC 3849 reserves for documentation. Nothing in that range routes. It is a natural place to hide data in plain sight, because to a casual eye it looks like filler.

So we decoded it. Take the third and fourth groups as four hex bytes, read them as an IPv4 address. All thirty produced globally routable addresses. Thirty for thirty. That felt like proof.

Then we checked who owns them.

One belongs to the United States Department of Defense. One belongs to the South Dakota state government. Others land on T-Mobile, Amazon, and China Unicom.

Those are not botnet nodes. Either our decoding is wrong, or those values are attack targets or spoofed source addresses rather than infrastructure. We do not currently know which, and we are not going to guess in public.

Zero of those decoded addresses went into our feed. Had we shipped them, every defender pulling our blocklist would have started dropping traffic to the DoD and a US state government on our say-so.

The lesson is uncomfortable and worth stating plainly: thirty for thirty globally routable is not validation. It felt like a signal and it was arithmetic. Global unicast space is enormous, so essentially any arbitrary hex will land inside it. We ran a check that could only ever come back positive, and briefly mistook that for confirmation. The ownership lookup is what turned a confident wrong answer into a known unknown, and it took ninety seconds.

If you are reading the same records and reaching the same decoding — check ownership before you act on it. That is the entire point of this section.

Now the OPSEC

He moved to the blockchain for permanence. He seems not to have thought through what else permanence applies to.

The ENS text records attached to the Dysphoria sales name are not limited to infrastructure. The operator also wrote in, on a public and immutable ledger: a full personal name, a specific residential street address, a Telegram account identifier, and a series of boasts — including a reference to being bailed on swatting charges, and shout-outs to named associates.

We are not republishing any of it. The intelligence value is zero — none of it helps anyone defend a network — and the harm potential is not zero. A person who has been through swatting proceedings knows exactly how a published address gets weaponized, and pointing a crowd at a street address on the strength of a criminal's own bragging is how an innocent family ends up with rifles on their lawn. The address may not even be his. We will note the category and leave the specifics to law enforcement, who can obtain them the same way we did, in about a minute.

But the errors themselves are worth cataloguing, because they are instructive:

He confused irreversibility with safety. He chose a substrate specifically because nothing on it can be removed. That property does not distinguish between his C2 pointers and his confession. There is no delete button for either. A forum post can be scrubbed when you sober up; an ENS text record is replicated across thousands of nodes and preserved in the chain's history forever, including every prior version.

He tied identity to infrastructure with a permanent key. The same address that controls the botnet's name records also carries the personal material. That is not two accounts that happen to be linked — it is one cryptographic identity, and every transaction it has ever made or will make is public and permanently correlated.

He advertised on the same record as the operations. The sales channel and the infrastructure live under one controller. Marketing needs to be findable; operations need to be hidden. Putting them on the same permanent identifier means the thing that has to be public drags along the thing that had to be private.

He geolocated himself. One of the Solana names is not random — it reads like a street address and a county. Anyone who noticed the naming pattern had a location before they had anything technical.

He wrote it down while facing charges. Referencing pending matters, on a ledger that cannot be edited, with a timestamp, is the sort of thing prosecutors do not usually have to work for.

None of this is a taunt. It is a genuinely useful case study in why "unstoppable infrastructure" and "safe infrastructure" are different properties. He optimized hard for the first and appears never to have asked what the first one does to the second. The chain that will not let the FBI take his C2 down also will not let him take his name off it.

What to do

Stop treating a sinkhole as a conclusion. JackSkid was disrupted in March by three countries and was operating again within days on infrastructure with no takedown surface. If your incident timeline ends at "C2 seized," it ends too early. Assume re-emergence and watch for it.

Patch CVE-2025-9528 on Linksys E1700 routers. This is the propagation vector. Consumer edge hardware is where this botnet lives, and almost nobody patches a router.

Watch for DNS resolution to blockchain name services. Malware resolving .eth or .sol names is not normal enterprise behaviour. Traffic to public ENS or SNS resolution endpoints from a server or an IoT segment deserves an alert. That is a behavioural detection, and unlike a domain block it survives the operator rotating names.

Audit UPnP on your network edge. The relay variant added UPnP port mapping specifically to punch through NAT. If your devices can open their own inbound ports, they can be made into relays. Most networks do not need UPnP at all.

Block the indicators. Three ENS names, one SNS name, two Ethereum addresses, one Telegram channel — all in our free feed. The on-chain identifiers are the durable ones. Names get abandoned; the controlling address is the pivot that holds.

The honest bit

We are 95 percent confident blockchain-resolved C2 keeps growing through the rest of the year, because Dysphoria is the clean proof of concept: enforcement removed the infrastructure, and the operator's answer was a substrate enforcement cannot reach. That is a lesson other crews will read.

The remaining five percent is the possibility that the same permanence problem catches enough of them that the tradecraft gets a bad reputation. On the evidence of this operator's text records, that is not an unreasonable hope.

Credit to CNCERT and to XLab at QiAnXin for the research, and to Comcast's threat lab and Nokia Deepfield for documenting the original JackSkid shift.

Free IP, domain, hash, and malicious-package blocklists at analytics.dugganusa.com.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.