China-nexus state-sponsored actors have scaled the JDY botnet to over 1,500 compromised SOHO and IoT devices, serving as a high-performance reconnaissance engine following the disruption of the KV-botnet. Targeting MIPS and MIPSEL Linux architectures, the botnet utilizes Tor-based C2 to orchestrate high-speed SYN scanning, banner grabbing, and TLS certificate collection. This infrastructure is primarily used for the industrialized mapping of U.S. military assets and critical infrastructure in the energy and defense sectors. By leveraging compromised edge devices from vendors like Cisco and Ubiquiti, actors mask malicious traffic within residential IP space to bypass geolocation and reputation-based filters during the preparation phase of the kill chain.

• Campaign Architecture: Distributed Scaling

  • Expanded from 650 bots in early 2024 to over 1,500 active nodes, with high concentrations in the United States and Brazil.
  • Evolved from a sub-cluster of the disrupted KV-botnet into a standalone, high-performance framework for industrialized reconnaissance.
  • Managed via Tor-based Command and Control (C2) infrastructure to anonymize operator origins and maintain persistence.

• Targeted Infrastructure: Edge Device Exploitation

  • Targets embedded Linux architectures across multiple vendors, including Cisco, Ubiquiti, Linksys, Hikvision, DrayTek, Araknis, and Mimosa Networks.
  • Compromises a diverse array of edge hardware, specifically routers, firewalls, DVRs, and smart thermostats.
  • Utilizes compromised residential IP space to blend malicious scanning traffic with legitimate home-user activity, evading traditional IP-reputation filters.

• Technical Mechanics: Scanning & Fingerprinting

  • Employs an adaptive scanning engine that prioritizes raw-packet SYN scanning for rapid port discovery upon obtaining necessary system privileges.
  • Utilizes threaded TCP/TLS connections for secondary "deep" fingerprinting, extracting application banners and TLS certificates.
  • Feeds structured reconnaissance data into a centralized triage ecosystem, allowing downstream APT groups to operationalize newly discovered vulnerabilities.

• Threat Actor Attribution: China-Nexus TTPs

  • Attributed to China-nexus actors, demonstrating significant operational overlap with Volt Typhoon and associated clusters like Voltzite.
  • Employs "Living-off-the-Land" (LotL) strategies by repurposing legitimate SOHO hardware rather than deploying heavy, detectable malware.
  • Maintains high resilience by pivoting quickly to the JDY framework following the 2024 U.S. government-led takedown of the KV-botnet.

• Operational Impact: Strategic Asset Mapping

  • Focuses on the "Preparation" phase of the cyber kill chain, specifically mapping U.S. military-affiliated networks and critical infrastructure (Energy, Oil & Gas).
  • Aims to minimize the window between the public disclosure of a vulnerability and the identification of targetable, unpatched services.
  • Provides a scalable mechanism for identifying high-value targets without triggering the alarms associated with data-center-based scanning.

• Defensive Strategy: Hardening the Edge

  • Disable all external-facing management interfaces (WMIs) on all SOHO and IoT devices to shrink the initial attack surface.
  • Deploy behavioral analytics to detect high-volume, anomalous SYN scanning patterns originating from residential IP ranges toward critical internal assets.
  • Implement Zero Trust architectures, mandating machine certificate verification and strict IP allow-lists for all remote access gateways.