China-nexus APT actors expand JDY botnet targeting U.S. military networks

BEIJING — Advanced persistent threat (APT) actors with ties to China have significantly expanded the scope of their operations using the JDY botnet, shifting focus toward United States military and associated government networks.

The campaign represents a sharp increase in activity over recent months. Data indicates the number of active bots within the network grew from approximately 650 devices in January 2024 to more than 1,500 compromised systems by early June 2026. The infected infrastructure includes small office/home office (SOHO) equipment and Internet of Things (IoT) gadgets located primarily across U.S. territory.

Security analysts identified the shift as a strategic move designed for reconnaissance purposes shortly after public vulnerability disclosures were released. By targeting specific vulnerabilities immediately following their disclosure, the actors aim to identify weak points in critical infrastructure before patches are widely deployed or defenses adjusted.

The JDY botnet has historically been associated with espionage and data exfiltration operations linked to state-sponsored groups operating out of China. The recent expansion suggests an operationalization phase intended to gather intelligence on defense-related networks rather than immediate disruption or ransom demands. This pattern aligns with long-term strategic objectives often observed in similar campaigns.

U.S. military officials have not publicly commented on the specific scale of compromise within their internal systems, though cybersecurity advisories regarding IoT vulnerabilities remain active across federal agencies. The timing of the expansion coincides with heightened global tensions and increased scrutiny over digital infrastructure security surrounding defense sectors.

The growth in botnet capacity allows for more distributed scanning capabilities, enabling attackers to probe a wider array of IP addresses simultaneously without triggering standard threshold-based alarms on individual networks. This method facilitates deeper mapping of target environments while maintaining operational stealth.

Questions remain regarding the specific data accessed or whether any exfiltration has occurred during this reconnaissance phase. The extent of lateral movement within compromised military-associated systems is currently unknown, as are the potential downstream impacts if these footholds are leveraged for future offensive operations.