JDY SOHO Botnet: 1,500+ Devices Scanning Indian Networks

The JDY SOHO botnet — a covert China-linked reconnaissance network — has expanded to over 1,500 compromised SOHO (Small Office/Home Office) and IoT devices worldwide, according to Lumen Technologies' Black Lotus Labs. Researchers describe a "resurgence and expansion" of JDY, operated by China-nexus state-sponsored threat actors as a centrally controlled, high-performance scanning engine that continuously discovers, fingerprints, and maps exposed internet services at scale.

This is not a smash-and-grab operation. JDY doesn't steal data directly — it does something more dangerous: it silently maps your network, identifies every exposed service, captures software version banners, and ships that intelligence to a command-and-control server controlled by state actors. The actual breach comes later, with surgical precision, using the reconnaissance blueprint JDY already assembled over weeks or months.

What makes JDY particularly insidious is its camouflage strategy. By routing malicious traffic through thousands of legitimate consumer devices — the kind sitting in home offices, small retail shops, and manufacturing units across India — it bypasses IP-reputation blocklists entirely and blends into normal internet noise. The device owner has no idea their office router is serving a foreign intelligence operation.

Why This Matters for Indian Businesses

India is not a passive observer in this threat landscape — it is a primary target. As someone who has reviewed hundreds of Indian SMB security postures over the past two years, I can tell you that the most common gaps I find are exactly the attack surfaces JDY is designed to exploit: unpatched consumer routers on factory firmware, IP cameras running admin/admin, and NAS devices with their management panels directly facing the internet.

Under the DPDP Act 2023 (Digital Personal Data Protection Act), Indian businesses are legally required to implement "reasonable security safeguards" to protect personal data. If JDY reconnaissance enables a subsequent breach of your customer database, the Data Protection Board could find you non-compliant — particularly if basic hygiene measures were neglected. The CERT-In 6-hour mandatory reporting directive gives you a dangerously small window to detect and respond to incidents that state-level, slow-burn recon operations are specifically designed to make you miss.

For fintech SMBs, NBFCs, and payment processors, the RBI's cybersecurity framework adds further obligation: JDY-style reconnaissance of your payment infrastructure could be the prelude to a precision attack your compliance posture never anticipated. For more coverage of APT threats targeting Indian businesses, follow the Bachao.AI blog.

SOHO Botnet Attack Flow: Technical Breakdown

Here is how the JDY botnet operates end-to-end, from initial device compromise through to intelligence exfiltration and eventual targeted breach:

Stage 1 — Initial Compromise: JDY's existing bot nodes scan the internet for SOHO routers and IoT devices with exposed management interfaces — typically ports 22 (SSH), 23 (Telnet), 80, 443, and 8080. Devices running firmware older than 12 months or factory-default credentials are trivially compromised using known CVEs or automated credential-stuffing.

Stage 2 — C2 Enrollment: Once compromised, the device silently registers itself with JDY's command-and-control (C2) infrastructure as a new scanning node. No unusual activity is visible to the device owner. Bandwidth impact is minimal by design — the goal is longevity, not speed.

Stage 3 — Reconnaissance at Scale: Each enrolled node receives scanning tasks from the C2 and probes assigned IP ranges for exposed services: RDP (3389), SSH (22), SMB (445), HTTP/S, FTP, Telnet, and increasingly OT/SCADA protocols used in Indian manufacturing. Service banners are captured to fingerprint exact software versions and identify applicable CVEs.

Stage 4 — Intelligence Aggregation: All reconnaissance data flows back to centrally controlled infrastructure, building a continuously updated, searchable database of exploitable internet services — indexed by IP, geography, service type, and software version. When a new zero-day drops, state actors instantly query this database for every vulnerable target worldwide.

In my years building enterprise systems, I saw this intelligence-before-attack pattern up close. Nation-state actors are patient. They map first, exploit later — sometimes months later. The gap between recon and breach is exactly the window where Indian SMBs have no visibility.

# IMMEDIATE: See what JDY sees when it scans your network
# Find your public IP first:
curl -s ifconfig.me

# Then scan your own perimeter (replace YOUR_PUBLIC_IP):
nmap -sV -p 22,23,80,443,445,3389,8080,8443 YOUR_PUBLIC_IP

# Check firewall logs for suspicious scanning activity on your server:
grep "DPT=22\|DPT=23\|DPT=3389\|DPT=445" /var/log/syslog | \
  awk '{print $12}' | sort | uniq -c | sort -rn | head -20
# Hundreds of hits from varied IPs on these ports = you are being scanned

# Verify Telnet is disabled (it must be):
sudo systemctl is-active telnet.socket 2>/dev/null && echo "TELNET ACTIVE - DISABLE NOW" || echo "Telnet inactive - good"

How to Protect Your Business

Quick Fix

# Step 1: Check if management ports are exposed to the internet
nmap -p 80,443,8080,8443,22,23,7547 $(curl -s ifconfig.me)
# Port 7547 (CWMP/TR-069) open = ISP management port exposed — call your ISP
# Port 23 (Telnet) open = critical — disable immediately

# Step 2: Permanently disable Telnet
sudo systemctl stop telnet.socket
sudo systemctl disable telnet.socket
sudo systemctl mask telnet.socket

# Step 3: Harden SSH — key-based auth only, no root, limited attempts
sudo tee /etc/ssh/sshd_config.d/hardening.conf <<EOF
PasswordAuthentication no
PermitRootLogin no
MaxAuthTries 3
LoginGraceTime 20
EOF
sudo systemctl reload sshd

# Step 4: Enumerate devices on your LAN to find forgotten SOHO/IoT gear
nmap -sn 192.168.1.0/24 | grep "Nmap scan report"
# Follow up on every IP you don't recognise — unknown devices = unknown risk

By the Numbers: SOHO Botnet Compromise Vectors

The pattern in the chart above is consistent across every threat intelligence report I have read: default credentials remain the single largest entry point for device compromise, followed closely by unpatched firmware CVEs. Both are entirely preventable with hygiene that takes under an hour to implement.

What the chart doesn't show is the multiplier effect. When JDY recruits a device via default credentials, it doesn't just compromise that one device — it gains a persistent scanning node inside your network segment, able to map internal services that were never exposed to the internet. That is how reconnaissance becomes a full internal network map.

How Bachao.AI Detects This

This is exactly the gap I built Bachao.AI to close — giving Indian SMBs the network visibility that Fortune 500 security teams take for granted, without requiring a dedicated security department or an enterprise-scale budget.

Start with what you can see. Run a free VAPT scan — it takes 5 minutes, requires no signup, and shows you exactly which services you are currently exposing to JDY-style scanners across the open internet.

Originally reported by The Hacker News

Frequently Asked Questions

Written by Shouvik Mukherjee, Founder & CEO of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

Written by Shouvik Mukherjee, Founder & CEO of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.