Researchers Say China-Linked JDY Botnet Now Spans 1,500+ Devices
Summary
Lumen's Black Lotus Labs says the JDY botnet has grown beyond 1,500 compromised SOHO/IoT devices, using layered C2 and targeted service fingerprinting to provide reconnaissance data to China-linked threat actors.
Key points
- Lumen's Black Lotus Labs reports JDY has grown from about 650 bots in January 2024 to more than 1,500 compromised devices.
- The report says most identified nodes are in the U.S. and Brazil, with others in Europe and Asia; the device mix now includes routers and IoT equipment from several vendors.
- JDY conducts targeted scanning and service fingerprinting to identify exposed infrastructure, rather than broad, indiscriminate probing.
- The operators use Tor-managed infrastructure, including C2 and payload servers, to direct scans and collect results for reconnaissance.
- Reported attack chains exploit newly disclosed edge-device vulnerabilities, including CVE-2026-35616, to deliver a shell-script dropper and architecture-specific payloads.
- The malware adapts its scanning methods to its privileges: it uses raw-socket SYN scans when available, and standard TCP/TLS or UDP and ICMP methods otherwise.
- Black Lotus Labs says JDY’s scanning data may support vulnerability targeting and follow-on operations by China-linked threat actors, including Volt Typhoon.
Article Details
- Attack Vectors
- JDY operators use compromised SOHO routers, firewalls, and IoT devices for targeted scanning and service fingerprinting.
- Attack chains exploit newly disclosed edge-device vulnerabilities, including CVE-2026-35616, to deliver a shell-script dropper that downloads an architecture-specific payload.
- The malware conducts high-volume TCP, SSL, UDP, and ICMP-assisted probing, captures scan responses, and reports results to central servers.
- When raw sockets are available, the malware performs SYN scans with custom-crafted TCP packets; otherwise, or for web scans, it uses standard TCP and TLS connections or UDP and ICMP.
- The malware is deleted from disk after launch.
- Defensive Notes
- Black Lotus Labs warns that distributed scanning from compromised SOHO and IoT devices can evade defenses relying on geofencing, IP reputation, or static blocklists.
- The article describes the botnet's scanning and reconnaissance activity but provides no specific remediation guidance.
MITRE ATT&CK
T1059.004 · Unix ShellA shell-script dropper is delivered as part of the edge-device infection chain.T1070.004 · File DeletionThe malware is deleted from disk after it launches.T1090.003 · Multi-hop ProxyThe operators use Tor nodes to manage the infected infrastructure, including C2 and payload servers.T1105 · Ingress Tool TransferThe dropper downloads the primary malware payload based on the infected device's processor architecture.T1595.002 · Vulnerability ScanningJDY bots conduct targeted vulnerability scanning of exposed infrastructure following public vulnerability disclosures.
CVE
Threat Actors
Malware
Vendors
AraknisJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.CiscoJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.DrayTekJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.HikvisionJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.LinksysJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.Mimosa Networksrouters, the present makeup of the botnet is a lot more diverse, including devices from Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys.UbiquitiJDY now includes a wider range of devices from vendors such as Cisco, Araknis, Ubiquiti, Draytek, Hikvision, and Linksys.