China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Security researchers have uncovered alarming growth in a sophisticated China-linked botnet known as JDY, which has now expanded to compromise over 1,500 small office and home office (SOHO) devices alongside Internet of Things (IoT) infrastructure. This expansive network functions as a powerful reconnaissance tool under centralized control, enabling threat actors to systematically discover, fingerprint, and continuously map exposed services across the internet at significant scale. The resurgence of JDY represents a concerning development in the landscape of state-sponsored cyber operations.

The JDY botnet operates by leveraging vulnerable SOHO and IoT devices, which typically lack robust security controls compared to traditional enterprise infrastructure. Once compromised, these devices form a distributed network capable of conducting extensive scanning activities without raising immediate suspicion. According to researchers at Lumen, the botnet's architecture allows for efficient coordination of scanning operations, making it particularly effective at identifying potential attack vectors across organizations worldwide. The attribution to China-nexus threat actors adds geopolitical dimensions to this technical threat.

Organizations