JDY
JDY is a Linux-based botnet and reconnaissance malware cluster linked by Black Lotus Labs to China-nexus state-sponsored activity and previously associated with Volt Typhoon and the broader KV-botnet. It operates as a centrally controlled, high-performance scanner rather than a DDoS platform or direct exploitation framework, and is used to discover, fingerprint, and continuously map exposed internet services at scale for downstream targeting.
Black Lotus Labs reported that JDY grew from roughly 650 observed bots in January 2024 to more than 1,500 compromised SOHO and IoT devices. The botnet has expanded beyond earlier compromises of Cisco RV320 and RV325 routers to include devices from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys. Infected infrastructure is distributed across Europe, Asia, and the Americas, with many nodes located in the United States and Brazil. Researchers assessed that this footprint helps operators evade geofencing, IP reputation controls, and static blocklists by blending malicious traffic with legitimate residential and small-office traffic.
JDY focuses on selective reconnaissance and service fingerprinting rather than indiscriminate internet-wide scanning. Reported capabilities include TCP, UDP, SSL/TLS, and ICMP-assisted probing; banner grabbing; TLS certificate and metadata collection; protocol fingerprinting; and flaw-focused reconnaissance shortly after public vulnerability disclosures. Black Lotus Labs observed scans tied to newly disclosed Fortinet-related vulnerabilities, including CVE-2026-35616, and assessed that JDY reconnaissance is rapidly operationalized to identify vulnerable infrastructure before patches are widely applied. Reported scan output includes JSON-formatted results containing IPs, ports, TTLs, banners, TLS versions, certificates, domains, URLs, redirects, and related metadata.
The malware samples described are built for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures. A lightweight bash dropper checks architecture, downloads the appropriate payload, executes it with a supplied C2 IP and group ID, and deletes the payload from disk. The malware fingerprints the host, sends an initial encrypted HTTPS POST beacon to /dispatch_service/v2/probe_status, retrieves encrypted tasking from a centralized dispatch service, and decrypts responses using the hardcoded AES key 0000000000000000bdb718bdf47cbcde. Supported commands include Exit, report_status, and update_dmap_fp_db. When running with sufficient privileges, JDY can perform high-speed raw-socket SYN scanning using a fixed source port of 19000; otherwise it falls back to standard TCP, TLS, UDP, or ICMP-based methods. Results are compressed and sent via HTTP POST to /data/v2/pscan using the filename attr.json.
JDY command-and-control and payload infrastructure is managed through concealed Tor nodes and hidden services. Some infected devices were reportedly managed using Platypus, an open-source reverse shell and host management tool; one cited payload server was 149.248.3[.]38 hosting a Platypus server on port 13339. Black Lotus Labs assessed that JDY continues to support multiple China-nexus APT actors by supplying timely reconnaissance data for follow-on exploitation and targeting. Reported targeting emphasized U.S. networks, with many scanned IPs associated with U.S. military and related entities.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attack chains weaponize newly disclosed vulnerabilities in edge devices (e.g., CVE-2026-35616) to deliver a shell script dropper that checks if the malware is already active, and if not, proceeds to download the primary payload based on the detected processor architecture. | Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state-sponsored threat actors. "The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devices and operates as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Black Lotus Labs recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat activity.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
4 techniques
Reconnaissance
The C2 systems direct bot devices to perform widespread multiprotocol scans that collect service and banner details and TLS certificates while conducting vulnerability-focused reconnaissance.
The malware that facilitates scanning and target reconnaissance is designed to fingerprint the host, receive scanning tasks from a central C2 server, carry out high-volume TCP, SSL, UDP, and ICMP-assisted probing, capture responses (TLS certificates, metadata, etc.), and report the results back to the dispatch server.
The malware that facilitates scanning and target reconnaissance is designed to fingerprint the host, receive scanning tasks from a central C2 server, carry out high-volume TCP, SSL, UDP, and ICMP-assisted probing, capture responses (TLS certificates, metadata, etc.), and report the results back to the dispatch server.
Black Lotus Labs found that JDY botnet operators target specific devices for scanning and reconnaissance, rather than conducting widespread, indiscriminate scanning. Most notably, there was a selective increase in scans of Fortinet equipment immediately after the disclosure of a new vulnerability, indicating the ability and intent to find and exploit vulnerable devices before patches are widely applied.
Initial Access
1 technique
Initial Access
Attack chains weaponize newly disclosed vulnerabilities in edge devices (e.g., CVE-2026-35616) to deliver a shell script dropper that checks if the malware is already active, and if not, proceeds to download the primary payload based on the detected processor architecture.
Stealth
1 technique
Stealth
Discovery
4 techniques
Discovery
The JDY botnet comprises over 1,500 small office and home office (SOHO) and Internet of Things (IoT) devices. It operates as a centrally controlled, high-performance scanner used to discover, fingerprint and continuously map exposed services at scale.
Determine the device architecture by probing available system utilities and parsing command output... Once executed, the malware begins by initializing several variables, including a hardcoded malware version... and a unique “probe_id,” which is computed by MD5 hashing system-specific information.
Command and Control
3 techniques
Command and Control
The initial check-in beacon is sent encrypted via an HTTPS POST request to the remote server address supplied via command line at the path /dispatch_service/v2/probe_status.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JDY is a covert botnet and reconnaissance malware platform operating on compromised SOHO and IoT devices. It is used for targeted scanning, service fingerprinting, and infrastructure mapping at scale, sending structured reconnaissance data back to central servers to support follow-on targeting and exploitation.
JDY is a distributed scanning and fingerprinting botnet used to locate targets vulnerable to newly disclosed flaws. It performs service discovery, banner grabbing, TLS certificate collection, protocol fingerprinting, TCP/UDP/ICMP scanning, and can conduct high-speed raw SYN scanning when running with sufficient privileges.
A Linux-based scanning and reconnaissance malware/botnet for SOHO and IoT devices that receives tasks from centralized C2 infrastructure, performs high-volume TCP, UDP, SSL, and ICMP-assisted probing, fingerprints exposed services, collects banners/TLS metadata, and reports structured results for follow-on target identification and exploitation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.