China-Linked JDY Botnet Expands as Recon Platform Targeting U.S. Military Networks

The China-linked JDY botnet has grown from roughly 650 devices in early 2024 to more than 1,500 compromised SOHO and IoT systems, according to Lumen Black Lotus Labs, and is being used primarily for cyber reconnaissance rather than disruptive attacks. Researchers said the infrastructure, previously tied to a cluster within KV-botnet and associated with Chinese state-backed activity including support for Volt Typhoon, performs scanning, service fingerprinting, banner grabbing, TLS certificate collection, and vulnerability-focused discovery. Many infected nodes are located in the United States and Brazil, and the activity shows a strong emphasis on U.S. military and related networks.

The operators reportedly move quickly after new vulnerabilities are disclosed, with researchers observing targeting tied to CVE-2026-35616 soon after Fortinet revealed the FortiClient EMS flaw, indicating reconnaissance data is being gathered for possible follow-on exploitation. JDY uses Tor hidden services for command-and-control, can leverage the Platypus reverse-shell and host-management framework, and adjusts its scanning techniques based on device privileges, including high-speed raw SYN scanning when elevated access is available. The report warns that compromised edge devices from multiple vendors are being folded into the botnet and urges organizations to patch routers, firewalls, and IoT devices, disable unnecessary internet-exposed administration, restrict remote management, replace default credentials, and watch for unusual outbound scanning.