Reporting describes an IoT botnet operating as Dysphoria rebuilding within six days of a takedown, using a public blockchain to publish command-and-control references rather than relying on domains or fixed addresses.
Takedown Depends On A Seizable Object
Every disruption this desk has filed this year — the servers in 26-0624, the proxy infrastructure in 26-0528 — worked because there was a thing in a jurisdiction that a court could order handed over.
A reference published to a distributed ledger has no such object. It is replicated by design across participants who are not party to the crime, cannot be deleted by anyone, and is retrievable by any infected device that knows where to look.
The Property That Makes It Useful Is The Property Being Abused
Censorship resistance and immutability are the design goals of a public ledger. They are the reason it is trusted for the purposes it was built for.
Those same properties make it an excellent bulletin board for infrastructure that must survive law enforcement attention. There is no defect being exploited here, which means there is no fix to deploy — the same conclusion this desk reached about prompt injection in 26-0509.
What Is Left
If the coordination layer cannot be removed, disruption has to happen elsewhere: at the infected device, at the network carrying the traffic, or at the payment layer where the operators realise value.
All three are harder, slower and less photogenic than seizing a server rack, and the enforcement announcements will look correspondingly less impressive. Graded medium — single-source reporting on the mechanism and the recovery interval.
Compiled from public reporting, listed below. The six-day recovery interval and the blockchain mechanism are as reported and we have not independently verified either. Corrections: corrections@forensicpost.com.