JDY: The botnet that makes your IoT a state-sponsored industrial recognition infrastructure

A new research report about a covert network named as JDY put on the table a pattern that we already know but is climbing: botnets composed of SOHO and IoT teams that not only serve to launch attacks, but act as a industrial recognition infrastructure State-sponsored operations. According to Lumen Black Lotus Labs, JDY has grown from a few hundred to more than 1,500 devices committed, and its main function is to discover, shape and map large-scale exposed services to feed target priority pipelines.

The JDY architecture shows two worrying features. First, diversity and geolocation of the nodes - mainly in the USA. The US and Brazil, but also in Europe and Asia - make the network an effective way to evade IP-based controls such as geofencing and blocklists. Second, control and communication through TOR and C2 servers allow operators to coordinate targeted scans according to priority, which indicates that the botnet does not carry out indiscriminate sweep but selective recognition for subsequent holding. The technical and contextual perspective of Black Lotus Labs is available on its official platform for further analysis.

Technically, the modus operandi described by the researchers is sober and efficient: exploitation of newly disclosed vulnerabilities on edge devices - for example the public reference to CVE-2026-35616 - to deploy a dropper that identifies the device architecture and downloads the appropriate payload. The malware erases the disk installer after running, fingerprints the host, receives scanning orders and returns useful metadata such as TLS certificates and service responses. The immediate objective is the systematic detection of vulnerable areas, not immediate exploitation but these results fuel subsequent attacks.

From a defensive point of view, this changes the priority: blocking IP addresses is no longer enough. The dispersion of legitimate traffic from domestic routers or cameras makes JDY traffic difficult to distinguish from normal. In addition, the ability of the scanning engine to change the technique according to local privileges - using raw sockets for SYN scan if it has root privileges, or TCP / TLS / UDP / ICMP connections in less privileged environments - makes static signatures less effective. The conclusion is clear: Defenses should focus on device hygiene, network segmentation and behavior monitoring, not just on black lists.

For domestic users and small office managers, practical recommendations remain strong: to park and update the firmware of routers, cameras and IoT devices as soon as the manufacturer publishes updates; to change credentials by default; to disable unnecessary remote management services; and to place these devices in separate networks of critical systems. Official risk management guides for IoT, such as those published by CISA, offer detailed steps to mitigate this type of threat and reduce the attack surface https: / / www.cisa.gov / identifying-and-managing-iot-cybersecurity-risks.

In medium and large organizations, the response should include proactive detection and response: implement output filters (egress) that limit unauthorized communications, establish lists of allowed for remote administration, monitor outgoing scanning patterns and correlate them with threat intelligence, and deploy detection of anomalies in TLS traffic and in massive port survey attempts. Coordination with ISPs to block or mitigate compromised nodes and the use of IOC feeds and telemetry are necessary steps to stop the operational impact of networks such as JDY.

At the level of public policy and market, JDY illustrates the need to require longer life cycles and safe updating mechanisms by consumer device manufacturers, as well as regulatory frameworks that encourage safety liability in IoT. The specific actions of cluster dismantling help, but do not eliminate a capacity that is reconstituted and adapted; therefore, resilience must be built before in device design and network infrastructure.

For security equipment that track the threat, it is useful to prioritize the search for characteristic artifacts: start scripts that remove the installer, peaks of outgoing connections that collect TLS certificates, communications with TOR nodes and scanning patterns that fit local privileges. Complementing these detections with the verification of device configurations in managed inventories will reduce the likelihood that JDY or other similar networks will find exploitable "back doors."

Finally, the technical community can deepen the details of the vulnerability mentioned through the NVD database to assess the scope and apply specific mitigation in its deployments: https: / / nvd.nist.gov / vuln / detail / CVE-2026-35616. The convergence between a network of diverse bots, remote control by TOR and an explicit purpose of recognition shows that contemporary threats are no longer just volumetric: they are operational intelligence capabilities reusable by actors with different objectives, and the response requires both immediate patches and structural changes in how we design, deploy and operate the Internet of Things.