A botnet connected to the Chinese state has expanded to 1,500 compromised routers and is identifying vulnerable targets within hours of their announcement.

      China-linked JDY botnet has expanded from 650 to over 1,500 hacked small office and home office devices. It identifies newly disclosed vulnerabilities within hours and sends targeting information to state-sponsored hackers. Research from Lumen’s Black Lotus Labs reveals that this covert botnet consists of more than 1,500 compromised routers, firewalls, and IoT devices, primarily located in the United States and Brazil.

      JDY was initially detected in December 2023 as part of the KV-botnet, a network utilized by the Chinese hacking group Volt Typhoon. The FBI dismantled KV-botnet in early 2024, but JDY survived, adapted, and is now characterized by Black Lotus Labs as an independent, highly effective reconnaissance tool.

      Rather than launching attacks directly, the botnet scans, fingerprints, and maps vulnerable services broadly, then relays the findings to Chinese state-sponsored groups for further exploitation. Black Lotus Labs describes it as an “industrialized reconnaissance effort,” with data continuously sent to central servers for intelligence purposes.

      The speed of operations is noteworthy as attack chains exploit newly announced vulnerabilities in edge devices to take control of routers and integrate them into the botnet. Once compromised, the bots conduct extensive TCP, SSL, UDP, and ICMP scans, capturing TLS certificates and service metadata to report back to control servers. The main aim is infrastructure mapping instead of direct exploitation.

      Since January 2024, the botnet has more than doubled in size, moving from 650 devices to over 1,500, with increased variety in the types of devices targeted. Initially focused on Cisco RV320 and RV325 routers, it now includes devices from Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys.

      This variety is intentional; by distributing scans across a broad range of IP addresses, the operators can avoid detection and blocking of any single IP. Utilizing compromised SOHO and IoT devices helps their traffic blend with regular user activity, while US-based devices allow them to bypass geofencing and IP reputation measures.

      The botnet's architecture is complex, with operators managing the infected infrastructure through Tor nodes that include both command-and-control servers and payload servers. The malware modifies its scanning techniques based on the privileges it has on the compromised device, using high-speed SYN scanning with custom packets when root access is obtained, and reverting to standard TCP and TLS connections when it isn't.

      According to Black Lotus Labs, “Disruption of individual nodes or clusters does not eliminate the underlying capability.” The capability persists, adapts, and continues to supply adversaries with timely targeting information, often shortly after a vulnerability is disclosed. Chinese state hacking operations have a history of targeting US infrastructure, and the JDY botnet demonstrates that the reconnaissance infrastructure is becoming more resilient.

      For cybersecurity defenders, the takeaway is clear: promptly patching edge devices is now essential. Routers and IoT devices that have reached end-of-life are especially vulnerable. Furthermore, traditional IP-based defenses are ineffective against scanning traffic that appears to originate from thousands of legitimate residential IPs throughout the country.