JDY Botnet Grows to 1,500 Devices for Rapid Vulnerability Mapping

The JDY botnet — attributed to Chinese state-linked actors including Volt Typhoon — has expanded to over 1,500 compromised SOHO and IoT devices and conducts high-speed reconnaissance by scanning for newly disclosed vulnerabilities within hours, collecting banners, certificates, and metadata via Tor-based C2 to feed targeting data to state hackers; this evolution from the KV-botnet increases risk to exposed edge infrastructure (routers, firewalls, VPNs, cameras) and complicates traditional IP-based defenses.