Back Ground.News

A Chinese state-linked botnet has grown to 1,500 hacked routers and is mapping vulnerable ...

Ground.News • June 11, 2026

A covert botnet linked to Chinese state- hackers has more than doubled in size and is now scanning for newly disclosed vulnerabilities within hours of publication. The JDY botnet comprises over 1,500 compromised small office and office routers, firewalls, and IoT devices, according to new research from Lumen’s Black Lotus Labs. Most of the […] This story continues at The Web

Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state- threat actors. "The JDY botnet comprises over 1,500 SOHO [small office and office] and IoT devices and operates as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale," Lumen's

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JDY Botnet Grows to 1,500 Devices for Rapid Vulnerability Mapping The JDY botnet, linked to Chinese state-sponsored actors, has expanded to over 1,500 compromised small office and IoT devices, primarily in the U.S. and Brazil. This botnet scans for newly disclosed vulnerabilities within hours, feeding targeting data to state hackers. Initially part of the KV-botnet, JDY has evolved into an independent reconnaissance tool following the takedown of KV in early 2024. The botnet employs a diverse range of devices, including routers and firewalls from various manufacturers, to evade detection. Its architecture utilizes Tor nodes for command and control, enabling high-speed scanning and data collection. JDY's activities highlight a significant shift in reconnaissance tactics, focusing on infrastructure mapping rather than direct attacks. This poses a growing challenge for enterprise security teams, as many edge systems remain poorly monitored. 10 sources 76

Extracted Entities

A Chinese state-linked botnet has grown to 1,500 hacked routers and is mapping vulnerable ...

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)