JDY is a malware botnet associated with Chinese threat actors, notably Volt Typhoon, that has grown from approximately 650 to over 1,500 compromised SOHO and IoT devices since early 2024. It focuses on reconnaissance activities such as service discovery, banner grabbing, TLS certificate collection, and protocol fingerprinting, with a particular emphasis on identifying vulnerable infrastructure shortly after public vulnerability disclosures. The botnet targets U.S. military and related networks predominantly. It compromises devices from vendors including Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys across MIPS and related architectures. JDY operators control the botnet via hidden Tor-based command-and-control infrastructure and use the open-source Platypus framework for reverse-shell and host management. The botnet performs high-speed, stealthy raw SYN scanning when it has administrative privileges, using custom-crafted TCP packets. The reconnaissance data collected is rapidly operationalized by China-nexus APT actors for exploitation.

JDY botnet's reconnaissance activities enable China-linked APT actors to rapidly identify and exploit vulnerable infrastructure, particularly within U.S. military and associated networks. The botnet's ability to scan and fingerprint devices shortly after vulnerability disclosures increases the risk of targeted attacks. Compromised SOHO and IoT devices contribute to the botnet's distributed scanning capabilities, potentially exposing sensitive military and related infrastructure to follow-on intrusions or exploitation.

There is no indication that the JDY botnet itself can be patched, as it is a distributed malware network. Organizations should ensure all routers, firewalls, and IoT devices are updated with the latest security patches to prevent compromise. Network device vendors are urged to eliminate vulnerabilities in SOHO router web management interfaces during design and development. Defenders should reduce the external attack surface by disabling unnecessary internet-exposed administrative interfaces, restricting remote management access, replacing default credentials, and monitoring for unusual outbound scanning activity from edge devices. These measures help prevent devices from being recruited into reconnaissance networks like JDY.