China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

This report details the resurgence and expansion of the JDY botnet, a China-linked reconnaissance network that has grown from 650 compromised devices to over 1,500.

• •JDY botnet comprises over 1,500 SOHO and IoT devices used for large-scale reconnaissance and vulnerability discovery
• •The botnet has expanded significantly since early 2024, with compromised devices primarily located in the U.S. and Brazil, including routers from multiple vendors (Cisco, Ubiquiti, Draytek, Hikvision, and Linksys)
• •Attack chains exploit recently disclosed vulnerabilities to deliver shell script droppers that deploy processor-specific payloads (mips, mips64, mipsel, mipsel64)
• •The malware performs high-volume TCP, SSL, UDP, and ICMP-assisted scanning with adaptive scanning methodology that adjusts based on local privileges and raw socket availability