China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

**JDY botnet resurgence:** JDY is a covert, high-performance SOHO/IoT reconnaissance botnet tied to China-nexus state-sponsored actors that has grown from ~650 to over 1,500 compromised devices and performs targeted scanning, fingerprinting, and data collection (including TLS metadata) to support downstream exploitation; it leverages Tor for C2, exploits disclosed edge-device vulnerabilities (e.g., CVE-2026-35616) to propagate, and its distributed footprint across U.S., Brazil, Europe, and Asia helps it evade IP-based defenses.