China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Back Thehackernews

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Thehackernews •[email protected] (The Hacker News) • June 10, 2026

Share: View original

Learn how to map hidden AI tools and agents directly to human owners. Join SailPoint to unify human, machine, and AI identities.

Learn how to validate automated pentesting results for accurate security decisions.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JDY Botnet Grows to 1,500 Devices for Rapid Vulnerability Mapping The JDY botnet, linked to Chinese state-sponsored actors, has expanded to over 1,500 compromised small office and IoT devices, primarily in the U.S. and Brazil. This botnet scans for newly disclosed vulnerabilities within hours, feeding targeting data to state hackers. Initially part of the KV-botnet, JDY has evolved into an independent reconnaissance tool following the takedown of KV in early 2024. The botnet employs a diverse range of devices, including routers and firewalls from various manufacturers, to evade detection. Its architecture utilizes Tor nodes for command and control, enabling high-speed scanning and data collection. JDY's activities highlight a significant shift in reconnaissance tactics, focusing on infrastructure mapping rather than direct attacks. This poses a growing challenge for enterprise security teams, as many edge systems remain poorly monitored. 10 sources 76

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)