Adversary Intelligence — 2026-06-11

China-Linked JDY Botnet Doubles in Size and Expands Targeting of US Military Networks

BLUFJDY's deliberate concentration of compromised US-based devices to mask military network scanning gives Chinese operators a persistent access pipeline that formal US attribution is unlikely to disrupt before year-end 2026.

Lumen Black Lotus Labs reported on June 10 that the JDY botnet has grown from approximately 650 devices in January 2024 to more than 1,500 compromised SOHO and IoT devices 123. The device base has diversified beyond the previous Cisco RV320/RV325 composition to include hardware from Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys 14. The botnet operates through concealed Tor nodes for command and control, with the dropper deleting the malware binary from disk immediately after execution 14. Black Lotus Labs found that the largest share of IP addresses JDY scanned belonged to U.S. military and associated networks, and observed a targeted spike in Fortinet device scans beginning within hours of CVE-2026-35616's public disclosure on April 5 14.

Analysis
Formal US government attribution of JDY to a named Chinese actor is unlikely by year-end 2026, with all technical findings resting on Lumen Black Lotus Labs alone. Moderate confidence rests on consistent Volt Typhoon victimology and the absence of pre-indictment signals in public reporting. JDY's deliberate concentration of compromised US-based SOHO and IoT devices blunts geofencing and IP-reputation defenses, leaving defenders without diplomatic backstop while adversaries face no disclosure-driven constraints. Same-day Fortinet scanning after CVE-2026-35616's April 5 disclosure confirms a live exploitation pipeline that compresses the patch window to hours. The spike in US military scanning may instead reflect exposed device density in DoD-adjacent commercial ISP ranges rather than deliberate targeting. Attribution before year-end would give CISA and NSC leverage for targeted sanctions or indictments; absent that, defenders are limited to unilateral hardening.
4 sources
  1. Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation - Lumen Black Lotus Labs
  2. China-linked JDY botnet expands targeting of U.S. military networks - BleepingComputer
  3. China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance - The Hacker News
  4. JDY Botnet Evolves After KV Takedown, Targets Military Networks - Security Affairs

View in full brief →

UNCLASSIFIED // OPEN SOURCE