Back Securityaffairs.Co

JDY Botnet Evolves After KV Takedown, Targets Military Networks

Securityaffairs.Co •Pierluigi Paganini • June 11, 2026

JDY botnet scans SOHO/IoT devices globally to map services and targets, especially US military networks. Lumen’s Black Lotus Labs reported the resurgence of the JDY botnet, a covert reconnaissance network tied to Chinese state- hacking groups including Volt Typhoon. The network was first spotted in late 2023 as a cluster inside KV-botnet. The U.S. government […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JDY Botnet Grows to 1,500 Devices for Rapid Vulnerability Mapping The JDY botnet, linked to Chinese state-sponsored actors, has expanded to over 1,500 compromised small office and IoT devices, primarily in the U.S. and Brazil. This botnet scans for newly disclosed vulnerabilities within hours, feeding targeting data to state hackers. Initially part of the KV-botnet, JDY has evolved into an independent reconnaissance tool following the takedown of KV in early 2024. The botnet employs a diverse range of devices, including routers and firewalls from various manufacturers, to evade detection. Its architecture utilizes Tor nodes for command and control, enabling high-speed scanning and data collection. JDY's activities highlight a significant shift in reconnaissance tactics, focusing on infrastructure mapping rather than direct attacks. This poses a growing challenge for enterprise security teams, as many edge systems remain poorly monitored. 10 sources 76

Extracted Entities

JDY Botnet Evolves After KV Takedown, Targets Military Networks

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Malware (2)

MITRE ATT&CK (1)