Summary Points
- The JDY botnet, now over 1,500 compromised IoT and SOHO devices, primarily in the U.S. and Brazil, is used for large-scale service scanning and infrastructure mapping, facilitating targeted attacks.
- Attackers exploit recent vulnerabilities in edge devices with a multi-stage payload, including system profiling, reconnaissance, and exploit delivery, often leveraging Tor for command-and-control.
- The botnet’s adaptive scanning techniques—high-speed SYN scans and standard connections—enhance asset discovery, vulnerability identification, and support subsequent exploitation efforts.
Threat Overview, Techniques, and Targets
Cybersecurity experts from Lumen’s Black Lotus Labs reported a major increase in the JDY botnet. This botnet is linked to Chinese state-sponsored threat actors. It now controls over 1,500 devices, including small office/home office (SOHO) devices and Internet of Things (IoT) gadgets. The botnet originally was part of the KV-botnet before becoming independent. It mainly infects devices from Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys. Most devices are in the U.S. and Brazil. The botnet works as a high-performance scanner. It looks for exposed services and maps out systems quickly. It uses Tor nodes for controlling the infected devices. These devices are directed to gather detailed system data. The attack chain begins when a newly discovered vulnerability is used to drop a shell script. This script then downloads the main malware payload. The botnet adapts its scanning method based on system privileges, using fast SYN scans or standard TCP/TLS connections. Its main goal is to find vulnerable devices for future exploitation.
Impact, Security Implications, and Guidance
The expanding JDY botnet can cause serious security problems. It can quickly find and target vulnerable systems. The data collected feeds into larger attack systems for potential exploitation. This situation increases the risk of cyberattacks on affected infrastructure. Organizations should take immediate steps. First, review and apply updates to vulnerable devices. Next, monitor network traffic for unusual activity, especially scanning behavior. Finally, consult with device vendors or security authorities for specific remediation guidance. Protecting devices from known vulnerabilities is critical. If needed, seek specialized advice to strengthen defenses against these threats.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
