China-Linked JDY Botnet Hijacks 1,500+ IoT Devices for Rapid Exploits

A significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat activity.

Once a component of the larger KV-botnet ecosystem, JDY has expanded to more than 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices and now functions as a high-performance, centrally controlled scanner that accelerates vulnerability discovery and operational targeting.

JDY’s growth is notable for both scale and diversity. Where the JDY cluster originally relied primarily on two Cisco router models, current telemetry shows devices from a broad set of vendors Cisco, Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision and Linksys distributed across Europe, Asia and the Americas, with a concentration in the United States.

This wide geographic and vendor dispersion lets operators disperse scanning traffic across thousands of residential and small enterprise IP addresses, evading IP-based controls such as geofencing, static blocklists and reputation systems and blending malicious reconnaissance into routine network noise.

Technical analysis of JDY samples reveals a purpose-built reconnaissance toolkit optimized for embedded Linux architectures (MIPS, MIPS64, MIPSEL).

A lightweight dropper probes device architecture, fetches the appropriate binary and launches a scanner that fingerprints hosts, performs high-volume TCP/UDP/SSL and ICMP-assisted probing, collects banners and TLS certificates, compresses structured scan results and reports back to centralized dispatch servers.

The malware’s adaptive scanning engine prefers raw-packet SYN scanning when it has sufficient privileges, enabling rapid port discovery with minimal application-level logging on targets; when raw sockets are unavailable it falls back to threaded TCP/TLS connections to capture richer application data.

JDY’s command-and-control (C2) and management are layered and obfuscated. Operators use hidden Tor services to conceal upstream management; some victim devices are managed via Platypus reverse-shell tooling.

Black Lotus Labs said in a report shared with GBhackers, identified a resurgence and expansion of the JDY botnet, a covert network linked to Chinese nation-state-backed actors, including Volt Typhoon.

The scanner retrieves encrypted tasking from a dispatch service, which supplies fingerprinting rules and scanning tasks dynamically.

China-Linked JDY Botnet

Fingerprint rule updates allow JDY to identify specific services (for example Oracle WebLogic) by protocol signatures and banner patterns rather than simple open/closed port states turning the botnet into a sophisticated asset-discovery and triage engine that feeds vulnerability pipelines.

Crucially, JDY demonstrates operational speed: Black Lotus Labs observed selective surges in scanning of Fortinet equipment within hours of public disclosure of CVE-2026-35616, indicating a deliberate capability to find vulnerable infrastructure before patches are widely applied.

Victimology patterns further show disproportionate scanning of U.S. military and related networks, consistent with earlier links between KV-botnet infrastructure and China-nexus advanced persistent threat (APT) actors such as Volt Typhoon.

For defenders, JDY illustrates why large distributed covert networks of compromised consumer devices are now foundational to modern reconnaissance and exploitation chains.

Detection is difficult because asset-level telemetry from infected routers and cameras is limited, scans originate from trusted residential address space, and the reconnaissance output is structured and rapidly operationalized by follow-on actors.

Black Lotus Labs recommends defenders adopt guidance such as the U.K. NCSC advisory on defending against China-nexus covert networks of compromised devices, harden SOHO and IoT deployments, monitor for high-volume, low-latency scanning patterns and anomalous outbound POSTs to uncommon endpoints (e.g., /dispatch_service or /data/v2/pscan).

Network teams should supplement IP reputation with behavior-based detection, segment critical networks from consumer-grade devices, and prioritize rapid patching for exposed infrastructure identified by JDY’s targeting patterns.

JDY’s revival underscores that takedowns of one cluster do not eliminate the reconnaissance tradecraft; botnets built from ubiquitous embedded devices remain a resilient reconnaissance vector that accelerates time from disclosure to exploitation.

Continued monitoring, rapid mitigations and a focus on IoT/SOHO hygiene are essential to blunt this capability.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.