China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation

Cybersecuritynews •Tushar Subhra Dutta • June 11, 2026

A China-linked network of compromised routers and smart devices has grown into one of the most capable reconnaissance tools tied to a nation-state threat group. Researchers have identified a major resurgence of a botnet known as JDY, which now controls more than 1,500 small office and office (SOHO) and Internet of Things (IoT) devices […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JDY Botnet Grows to 1,500 Devices for Rapid Vulnerability Mapping The JDY botnet, linked to Chinese state-sponsored actors, has expanded to over 1,500 compromised small office and IoT devices, primarily in the U.S. and Brazil. This botnet scans for newly disclosed vulnerabilities within hours, feeding targeting data to state hackers. Initially part of the KV-botnet, JDY has evolved into an independent reconnaissance tool following the takedown of KV in early 2024. The botnet employs a diverse range of devices, including routers and firewalls from various manufacturers, to evade detection. Its architecture utilizes Tor nodes for command and control, enabling high-speed scanning and data collection. JDY's activities highlight a significant shift in reconnaissance tactics, focusing on infrastructure mapping rather than direct attacks. This poses a growing challenge for enterprise security teams, as many edge systems remain poorly monitored. 10 sources 76

Extracted Entities

China-Linked JDY Botnet Uses 1,500+ SOHO and IoT Devices for Rapid Vulnerability Exploitation

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)