China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Security researchers report a resurgence and expansion of the JDY botnet, a covert network attributed to China-nexus state-sponsored threat activity. JDY now targets more than 1,500 SOHO and IoT devices and operates as a centralized scanner to discover, fingerprint, and continuously map exposed services for later exploitation. The activity includes use of edge-device vulnerabilities such as CVE-2026-35616, highlighting ongoing risk to internet-facing infrastructure and the persistence of reconnaissance capabilities even after related takedowns.