Chinese JDY botnet reaches 1,500+ devices, scans flaws

A botnet linked to Chinese state-sponsored hackers has more than doubled in size and is now being used to rapidly scan for newly disclosed software vulnerabilities, often within hours of their public announcement, according to new cybersecurity research. The network, tracked as JDY, comprises over 1,500 compromised small office and home office routers, firewalls, and Internet of Things devices, primarily located in the United States and Brazil.

Researchers at Lumen's Black Lotus Labs reported that JDY operates as a centrally controlled, high-performance scanning engine designed for reconnaissance, not direct attacks. Its purpose is to discover, fingerprint, and continuously map exposed internet-facing services at scale, feeding structured intelligence to hacking groups for follow-on exploitation. The activity is linked to Chinese nation-state-backed actors, including the group known as Volt Typhoon.

JDY was first identified in December 2023 as a component of a larger botnet called KV-botnet, which was taken down by U.S. authorities in early 2024. JDY survived that disruption, however, and has since evolved into an independent and more durable capability. The botnet has grown...