Loading malware…
JDY is a Linux-based reconnaissance botnet associated with China-nexus state-sponsored activity, including Volt Typhoon. Publicly identified in 2023 as a scanning cluster within the KV-botnet ecosystem, it remained operational after disruption of the companion KV cluster in late 2023 and early 2024. By June 2026, JDY had expanded from approximately 650 active devices in January 2024 to more than 1,500 compromised small-office/home-office and IoT devices across the Americas, Europe, and Asia, with a substantial concentration in the United States. Its reconnaissance activity has shown a pronounced focus on U.S. military and associated networks.
JDY runs on MIPS-family routers and embedded systems, including devices from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys. Infection chains exploit vulnerable internet-exposed edge devices and deploy a shell-script dropper that selects an architecture-compatible payload, launches it, and removes the downloaded binary from disk. Operators use concealed Tor-based management infrastructure, and some compromised devices are additionally managed through the Platypus reverse-shell framework.
The malware registers with a centralized dispatch service, reports host characteristics, and receives encrypted scanning assignments and downloadable service-fingerprinting rules. It supports TCP, TLS, UDP, and ICMP-assisted probing, collecting service banners, certificate metadata, protocol characteristics, and web responses. When sufficient privileges permit raw sockets, it performs high-speed SYN scanning; otherwise, it falls back to conventional connections. Structured reconnaissance results are compressed and returned to command-and-control infrastructure.
JDY primarily supplies asset-discovery and vulnerability-targeting intelligence for follow-on operations rather than directly exploiting scanned targets. Its operators rapidly redirect scanning toward newly disclosed vulnerabilities. Distributing reconnaissance across compromised residential and small-business devices helps blend malicious traffic with legitimate activity and evade geofencing, reputation filters, and static blocklists.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
...increased exploitation activity against vulnerable SOHO devices directly exposed to the internet with the apparent target objective of expanding a botnet named “JDY” believed to be used by the threat actor for scanning/reconnaissance activity.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The report revealed that the botnet is intentionally used as a conduit to feed “structured reconnaissance data” into a broader Chinese state scanning infrastructure.
By distributing scanning and fingerprinting across thousands of compromised SOHO and IoT devices, operators can rapidly identify vulnerable infrastructure and targets of interest while evading traditional, IP-based defenses.
Several prominent cyber threat intelligence reports published in 2026 detail how Chinese state-sponsored threat actors are evolving their use of scanning and reconnaissance tools. Rather than relying on simple, indiscriminate network scans, these groups have industrialized their reconnaissance phase...
Black Lotus Labs found that JDY botnet operators target specific devices for scanning and reconnaissance, rather than conducting widespread, indiscriminate scanning. Most notably, there was a selective increase in scans of Fortinet equipment immediately after the disclosure of a new vulnerability, indicating the ability and intent to find and exploit vulnerable devices before patches are widely applied.
The JDY botnet is back and expanding via attacks on unpatched routers, cameras and other edge devices... JDY botnet now makes up 1,500 compromised small office and home office (SOHO) devices, as well as edge and Internet of Things (IoT) devices.
...detailed increased exploitation activity against vulnerable SOHO devices directly exposed to the internet with the apparent target objective of expanding a botnet named “JDY”...
A lightweight bash dropper handles infection: it detects the device’s processor type, downloads the matching payload, executes it, and deletes the file from disk.
A lightweight bash dropper handles infection: it detects the device’s processor type, downloads the matching payload, executes it, and deletes the file from disk.
...with the apparent target objective of expanding a botnet named “JDY” believed to be used by the threat actor for scanning/reconnaissance activity.
Determine the device architecture by probing available system utilities and parsing command output... Once executed, the malware begins by initializing several variables, including a hardcoded malware version... and a unique “probe_id,” which is computed by MD5 hashing system-specific information.
Query the running process list to determine whether the malware is already active... Write the payload to /etc/ or /tmp/ (depending on disk space and permissions), set execute permissions, launch the malware... and then delete the payload from disk.
Determine the device architecture by probing available system utilities and parsing command output (using variations of hexdump, read, dd, awk or similar). Download the appropriate payload... using available tooling (busybox, curl, wget, or wget-ssl).
Previous reports have noted that Volt Typhoon has used Tor for its C2 communications, so this traffic may reflect C2 communications between different Volt Typhoon-controlled resources...
Since infected devices are ordinary home and small business routers, their traffic blends in with normal internet activity, making detection harder for traditional security tools.
If this observation that 67.205.139[.]175 does not appear to have hosted a Tor exit node during the relevant timeframe is correct, it could be surmised that Volt Typhoon may not have leveraged Tor’s capability to connect to normal destinations on the internet... for obfuscating their source IP address while conducting administrative tasks.
Bots perform multiprotocol scans across TCP, UDP, SSL, and ICMP channels, then send compressed, encrypted results back to the central server.
A lightweight bash dropper handles infection: it detects the device’s processor type, downloads the matching payload, executes it, and deletes the file from disk.
Some devices are also managed through Platypus, an open-source remote shell tool, with the payload server at 149.248.3[.]38 hosting a Platypus instance on port 13339.
Infected devices receive scanning tasks from a command-and-control server communicating via hidden Tor nodes, making it nearly impossible to trace back to operators. Bots perform multiprotocol scans across TCP, UDP, SSL, and ICMP channels, then send compressed, encrypted results back to the central server.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.