JDY Botnet Turns 1,500 Compromised SOHO Devices Into a Nation-State Targeting Engine
Lumen's Black Lotus Labs links the scanning network to Volt Typhoon. The threat isn't the botnet itself — it's the reconnaissance data it harvests before you've even read the CVE advisory.
Reconnaissance has a new assembly line.
Lumen's Black Lotus Labs is tracking a botnet, designated JDY, built from more than 1,500 compromised small-office and IoT devices. Its purpose isn't credential theft or DDoS. It exists to discover, fingerprint, and continuously map internet-exposed services — including perimeter devices like routers, firewalls, VPNs, and cameras — with a particular interest in newly disclosed vulnerabilities.
Lumen attributes the activity to Chinese nation-state actors, including Volt Typhoon.
The botnet's distributed architecture is the point. Scans originate from what looks like legitimate residential and small-business traffic, undermining IP-reputation controls and geofencing. Those defenses were already structurally weak against rotating infrastructure. JDY makes that weakness operational.
Black Lotus Labs observed a selective spike in scans targeting Fortinet equipment shortly after the disclosure of CVE-2026-35616. Selective is the operative word. JDY isn't generating noise — it's querying for specific exposure.
For enterprise defenders, two problems compound each other.
First, edge devices — the exact category JDY focuses on — sit outside most endpoint detection programs. No EDR agent on a firewall management plane. No meaningful telemetry from a SOHO router. This is a known visibility gap; JDY is exploiting it deliberately.
Second, traditional SLA-driven patching cycles assume defenders have a working window between disclosure and active exploitation. JDY compresses that window to near-zero. By the time a CVE hits the NVD, the botnet may already hold a map of which IPs are running the vulnerable service version.
As one researcher framed it: exploitation no longer begins when malicious code arrives. It begins when exposure is discovered.
That reframing matters for how CISOs categorize this threat. JDY isn't a commodity botnet. It's pre-exploitation infrastructure — a scanning layer that feeds targeting intelligence to follow-on operations. The 1,500 compromised devices are not the final objective; they are the collection apparatus.
Practical response looks like pre-approved playbooks for perimeter systems: accelerated patching tracks for internet-facing devices, ACL changes on short notice, temporary feature disablement, and locked-down management interfaces. Static blocklists won't cut it.
The metadata JDY collects — IP addresses, open ports, service banners, TLS versions, certificate details, associated domains — gives operators a dossier on your edge before a patch even ships. That's the uncomfortable part. By the time defenders act on a new advisory, the attacker may already know exactly who to target.
