China-linked JDY botnet expands targeting of U.S. military networks
Researchers say the JDY botnet has grown and is being used to scan and fingerprint targets, with a strong focus on U.S. military-linked networks.
Intelligence analysis by GPT-5.4 Mini
Black Lotus Labs says the China-linked JDY botnet has more than doubled since early 2024 and is now heavily used for reconnaissance against U.S. military and related networks. The botnet is not mainly a volume attack tool; it is a scanning network that helps operators find newly exposed weaknesses fast.
A sneaky robot helper on the internet is using lots of hacked gadgets like small home routers to look around for weak spots in military-related networks. It is like a burglar sending out tiny scouts before choosing which door to try.
Analysis
What JDY is doing
Black Lotus Labs says JDY has expanded from about 650 active bots in January 2024 to more than 1,500 compromised SOHO and IoT devices. The group’s main value is reconnaissance: it scans, fingerprints, and collects service details so operators can quickly spot systems that match newly disclosed flaws.
Why defenders should care
The report says the botnet keeps a strong U.S. focus, with military and related entities standing out as the most targeted. That fits earlier CISA warnings about the risks posed by exposed SOHO routers and their web management interfaces, especially when they are left open to the internet.
How the botnet works
JDY can do service discovery, banner grabbing, TLS certificate collection, UDP and ICMP probing, and service fingerprinting through downloadable rules. It runs through hidden Tor services that act as command-and-control infrastructure, and in some cases the operators also use the Platypus remote-management framework.
The malware registers with a central dispatch service, receives scan jobs, executes them, compresses the results, and sends them back. Researchers say its TCP scanning can become especially fast and stealthy when it has elevated privileges, using raw SYN packets for high-speed scanning.
Devices and response
Lumen says compromised devices include products from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys. The operators were also quick to probe a newly disclosed Fortinet flaw shortly after it was announced. The recommended defense is basic but important: patch routers, firewalls, and IoT devices, disable unnecessary admin interfaces, restrict remote management, replace default credentials, and watch for unusual outbound scanning from edge devices.
Key points
- Black Lotus Labs says JDY has expanded from about 650 active bots in January 2024 to more than 1,500 compromised devices.
- The botnet is used mainly for reconnaissance, not mass disruption, and focuses heavily on U.S. military and associated networks.
- JDY can perform service discovery, banner grabbing, TLS collection, protocol fingerprinting, and flaw-focused scanning.
- The operators use hidden Tor services for command and control, and sometimes use the Platypus framework.
- Defenders are urged to patch edge devices, restrict remote admin access, and watch for unusual outbound scanning.
The report gives defenders a clearer picture of how JDY operates, which can help them block its scans and harden exposed devices. If organizations patch edge gear and close remote management access, the botnet has fewer places to recruit and fewer targets to map.
If the scanning network keeps growing, it could keep feeding fresh targeting data to advanced threat actors soon after new flaws are disclosed. Unpatched routers and IoT devices could remain easy footholds, letting the botnet continue to support reconnaissance against sensitive networks.
