A botnet associated with the Chinese state has expanded to include 1,500 compromised routers and is identifying susceptible targets within hours of being revealed.

      **Summary**: The JDY botnet, linked to Chinese state-sponsored hackers, has increased from 650 to over 1,500 compromised small office and home office devices. This botnet scans for newly disclosed vulnerabilities within hours and provides targeting information to state-backed hackers. Identified in December 2023 as part of the KV-botnet used by the Volt Typhoon hacking group, JDY has evolved into an independent reconnaissance tool after the takedown of KV-botnet by the FBI in early 2024.

      Rather than launching direct attacks, JDY conducts scanning, fingerprinting, and mapping of exposed services, sending the results to Chinese state actors for further exploitation. The speed of its operations is impressive, as it exploits new vulnerabilities in devices to compromise routers and grow its network. As of now, the botnet includes a wider variety of devices, having transitioned from solely targeting Cisco routers to compromising models from various manufacturers including Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys.

      This diversity in targeting helps the botnet avoid detection, as it uses a broad range of IP addresses, deploying compromised devices that blend in with legitimate traffic. The operators utilize layered management through Tor nodes, and the malware adjusts its scanning techniques based on the level of access it has. Black Lotus Labs noted that disrupting individual nodes does not diminish the botnet's overall capabilities, which continue to adapt and provide swift targeting data following vulnerability disclosures. As a result, timely patching of edge devices is crucial, as traditional defenses are ineffective against scanning from numerous legitimate-seeming residential IP addresses.