JDY

JDY is a botnet and reconnaissance capability linked to Chinese state-sponsored threat actors. Initially associated with the KV-botnet, it later emerged as a distinct capability after disruption of KV in early 2024. JDY primarily compromises SOHO and IoT edge devices and uses them as a distributed platform for large-scale scanning, service fingerprinting, and mapping of exposed infrastructure. Its activity is oriented toward rapid identification of vulnerable systems, including shortly after public disclosure of new vulnerabilities, and the resulting telemetry supports downstream target selection and exploitation workflows. JDY operates through a covert management architecture that includes Tor-based infrastructure and command-and-control used to task bots for detailed system profiling. The malware can adapt its scanning behavior based on available privileges, using higher-performance SYN scanning when elevated privileges are present and falling back to standard TCP and TLS-based probing when they are not. Reported intrusion chains include exploitation of newly disclosed vulnerabilities in edge devices and delivery of a shell-script-based dropper to install the primary payload. The botnet has been observed at substantial scale across compromised networking and surveillance-related devices from multiple vendors. Its role is best characterized as industrialized reconnaissance rather than ransomware or disruptive operations, providing asset discovery and vulnerability-targeting support within a broader Chinese state-linked operational ecosystem.