Researchers Disclose Growth of China-Linked JDY Botnet

A long-tail proxy network that quietly maps the internet — and a reminder that reconnaissance infrastructure is its own defender problem.

MONROE, LA — Researchers have disclosed a resurgence and expansion of JDY, a China-linked covert network of compromised devices that, according to the reporting, has grown past 1,500 nodes and is used to map exposed services across the internet at scale. The findings, published by Lumen's Black Lotus Labs and reported by The Hacker News, describe JDY not as a tool for breaking into networks directly but as reconnaissance-supporting infrastructure — a centrally controlled scanner that discovers and fingerprints exposed services to feed follow-on targeting.

The disclosure is a useful prompt for defenders to account for a layer of threat infrastructure that is easy to overlook. JDY is small-footprint and long-tail by design: built from everyday small-office/home-office routers and IoT devices rather than a single hosting provider, it blends scanning traffic into ordinary internet noise. The story here is the research, what it reports, and what it means for detection — not how the operators acquire their devices.

What the Disclosure Reports

According to The Hacker News, researchers at Lumen's Black Lotus Labs warned of a "resurgence and expansion" of JDY, which the reporting describes as a covert network associated with China-nexus activity. The central, verifiable claim is one of scale: the network is reported to comprise more than 1,500 small-office/home-office (SOHO) and IoT devices, up from roughly 650 nodes measured at the start of January 2024.

The reporting characterizes JDY's function precisely. Rather than a tool used to break into targets, it is described as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale. The output of that scanning — structured reconnaissance data — is reported to feed a larger ecosystem for follow-on target identification. In other words, the value of JDY to its operators is intelligence, not intrusion.

JDY is not new. According to the reporting, it was first flagged as a cluster within a separate network codenamed the KV-botnet in late 2023, and it persisted and adapted after law-enforcement action against that broader network in early 2024. The throughline of the disclosure is durability: the researchers frame JDY as an example of how reconnaissance capability persists and adapts even after individual clusters are disrupted.

Why Small-Footprint Proxy Networks Matter to Defenders

The defender-relevant point is not the device count itself but what that kind of network buys an operator. A scanning layer built from residential and small-business devices distributes activity across a wide range of IP addresses, which makes it less likely that any single address will be flagged as a scanner and blocked. According to Black Lotus Labs, that distribution lets the operators blend reconnaissance into legitimate-looking traffic and evade IP-based controls such as geofencing, reputation scoring, and static blocklists. It is a quieter cousin of the kind of distributed infrastructure seen in other China-aligned operations CyberSignal has covered.

Reconnaissance infrastructure is also a force multiplier for whatever comes next. A network that continuously fingerprints exposed services produces a standing, refreshable map of vulnerable internet-facing systems. The reporting indicates JDY's scanning is oriented toward flagging vulnerable infrastructure following public vulnerability disclosures — meaning newly announced flaws can be matched against an existing inventory of exposed devices quickly. For defenders, that compresses the window between a vulnerability becoming public and that vulnerability being actively sought out in the wild.

This is why a botnet that never "attacks" you in the conventional sense still belongs in a threat model. The reconnaissance layer is where target lists are built. Treating scanning infrastructure as a distinct concern — separate from the exploitation that may follow — is the practical takeaway from a disclosure like this one.

Detection Considerations for Reconnaissance-Supporting Infrastructure

Because JDY is built to evade IP-based controls, detection that relies solely on blocklists or reputation feeds is, by design, a weak defense. The reporting describes scanning that spans TCP, TLS, UDP, and ICMP probing, captures responses such as TLS certificates and service metadata, and reports results back to central infrastructure. That behavioral profile is more useful to defenders than any single indicator: high-volume, low-yield connection attempts and service-fingerprinting patterns are detectable as behavior even when the source addresses rotate.

The most durable defensive posture is to reduce what a scanner can find in the first place. Minimizing internet-exposed services, retiring end-of-life devices, and closing known-vulnerable configurations shrink the attack surface a reconnaissance network can map. These are the same fundamentals that anchor any vulnerability-management program — and they are precisely the controls that blunt an industrialized scanning operation, which is only as valuable as the exposed services it can discover.

Finally, defenders should fold disclosures like this into their understanding of the broader landscape. JDY is one piece of a larger pattern of China-linked infrastructure that CyberSignal has tracked, including covert command-and-control built on consumer platforms in the WebWorm campaign. Knowing that a standing reconnaissance layer exists — and that it operationalizes new vulnerabilities quickly — is itself a reason to prioritize fast patching of internet-facing systems.

Open Questions and Attribution Gaps

Several specifics remain unconfirmed, and the brief's guardrails apply. The reporting links JDY to China-nexus activity, but the specific threat actor operating the network is not established in a way that should be asserted; the disclosure ties the reconnaissance output to Chinese state objectives without confirming a single named operator. That is a meaningful gap, especially given how much China-linked espionage activity CyberSignal has documented spans overlapping, hard-to-disentangle clusters.

Other details should be treated as reported rather than settled: the precise device types and geographic distribution of the compromised nodes, whether JDY overlaps with previously named clusters beyond its KV-botnet lineage, and the exact downstream operations the reconnaissance supports. None of those are confirmed here, and reading more into them would overstate the disclosure.

What is solid is enough to act on. A China-linked reconnaissance network has grown past 1,500 devices, is designed to evade IP-based defenses, and feeds a pipeline that operationalizes new vulnerabilities quickly. For defenders, the response is not to chase rotating addresses but to shrink the exposed surface those scanners exist to find — and to treat reconnaissance infrastructure as a first-class part of the threat picture, not an afterthought.

Sources