China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
Summary: Lumen's Black Lotus Labs reported that the JDY botnet, a China-nexus cluster first identified within the KV-botnet in mid-December 2023, has grown from 650 bots in early January 2024 to more than 1,500 compromised SOHO and IoT devices used for targeted scanning and service fingerprinting. Most infected nodes are in the U.S. and Brazil, followed by Europe and Asia, and the device mix has broadened from Cisco RV320/RV325 routers to Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys gear, most of it end-of-life with known vulnerabilities.
Why it matters: The botnet's U.S.-based devices let operators spread scanning across many IPs and blend with legitimate traffic, undermining geofencing, IP reputation, and static blocklists - and Black Lotus says this targeting data can reach adversaries within hours of a vulnerability disclosure.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2021-36260CVE-2022-32548CVE-2023-20118CVE-2023-24738
- Related
- CVE-2023-20118: Cisco Small Business RV Series Routers Command Injection Vulnerability Known Exploited Vulnerabilities · Mar 03, 2025CVE-2021-36260: Hikvision Improper Input Validation Known Exploited Vulnerabilities · Jan 10, 2022