cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

JDY Botnet Expands to More Than 1,500 Devices, Targets U.S. Military Networks

· Original article ↗

Summary

Black Lotus Labs reports that the JDY botnet has grown to more than 1,500 SOHO and IoT devices, focusing on U.S. military-related targets and scanning for newly disclosed vulnerabilities. Its operators use Tor-based command-and-control.

Key points

  • Black Lotus Labs says JDY grew from about 650 active bots in January 2024 to more than 1,500 compromised SOHO and IoT devices.
  • Researchers report a strong focus on U.S. military and associated networks; the article describes JDY as a reconnaissance and scanning network, not a DDoS botnet.
  • JDY performs service discovery, banner collection, TLS certificate harvesting, protocol fingerprinting, and scanning for newly disclosed flaws.
  • Researchers observed JDY scanning for CVE-2026-35616 shortly after Fortinet publicly disclosed the FortiClient EMS flaw.
  • Operators use hidden Tor services for command-and-control; the malware receives scanning assignments, returns compressed results, and can use the Platypus framework.
  • When it has sufficient privileges, JDY can perform raw SYN scans using custom packets, a fixed source port of 19000, and batches of thousands of targets.
  • The article recommends patching routers and IoT devices, limiting exposed administrative interfaces and remote management, replacing default credentials, and monitoring unusual outbound scanning.

Article Details

Attack Vectors
  • Compromised SOHO routers and IoT devices are used as distributed scanning and fingerprinting nodes.
  • JDY scans for newly disclosed vulnerabilities, including CVE-2026-35616, and performs service discovery, banner collection, TLS certificate collection, and protocol fingerprinting.
  • Operators control the botnet through hidden Tor services; the article says Platypus is also used in some cases.
Defensive Notes
  • Keep routers, firewalls, and IoT devices updated with the latest security patches.
  • Disable unnecessary internet-exposed administrative interfaces and restrict remote management access.
  • Replace default credentials and monitor edge devices for unusual outbound scanning.

MITRE ATT&CK

T1046 · Network Service DiscoveryJDY performs service discovery, TCP/UDP and SSL/TLS scanning, banner collection, and service fingerprinting from compromised devices.T1090.003 · Multi-hop ProxyOperators use hidden Tor services as command-and-control infrastructure for the JDY botnet.T1595.002 · Vulnerability ScanningJDY scans for systems vulnerable to newly disclosed flaws, including CVE-2026-35616.

CVE

CVE-2026-35616Fortinet · FortiClientEMSJDY quickly targets newly disclosed flaws, including CVE-2026-35616.

Threat Actors

Volt TyphoonThe article says JDY was previously associated with Chinese threat actors such as Volt Typhoon and notes CISA warnings about risks posed by Volt Typhoon operatives to unprotected SOHO routers; it does not definitively attribute operation of JDY to Volt Typhoon.

Malware

JDYJDY botnet has expanded from about 650 active bots to more than 1,500 compromised SOHO and IoT devices, with a strong focus on the United States and military-related targets.

Vendors

AraknisAmong the compromised devices are those from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures.CiscoBlack Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet.DrayTekAmong the compromised devices are those from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures.FortinetBlack Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet.HikvisionBlack Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet.LinksysBlack Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet.Mimosa NetworksAmong the compromised devices are those from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures.UbiquitiBlack Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet.

Products

FortiClient EMSThe threat actors are quick to target newly disclosed vulnerabilities, with Lumen researchers observing JDY scans targeting CVE-2026-35616 shortly after Fortinet publicly disclosed the FortiClient EMS flaw.

Tools

PlatypusThe open-source reverse-shell and host-management framework Platypus is also used in some cases.

Countries

United StatesJDY botnet has expanded from about 650 active bots to more than 1,500 compromised SOHO and IoT devices, with a strong focus on the United States and military-related targets.

Industries

MilitaryJDY botnet has expanded from about 650 active bots to more than 1,500 compromised SOHO and IoT devices, with a strong focus on the United States and military-related targets.

Related Articles