Cybersecurity researchers have warned of a 'resurgence and expansion' of JDY, a covert network associated with China-nexus state-sponsored threat actors. According to Lumen's Black Lotus Labs, JDY now comprises over 1,500 SOHO (small office and home office) and IoT devices and operates as a centrally controlled, high-performance scanner used to discover, fingerprint, and continuously map exposed services at scale. The botnet has grown significantly from 650 devices at the start of January 2024 to more than 1,500 compromised devices following the takedown of its parent botnet KV-botnet by the U.S. government in early 2024. The malware is designed to fingerprint hosts, receive scanning tasks from a central C2 server, carry out high-volume TCP, SSL, UDP, and ICMP-assisted probing, capture responses, and report results back to the dispatch server. As reported by Black Lotus Labs, JDY's large number of U.S.-based SOHO/IoT devices enables the botnet operators to evade defenses and traditional IP-based controls, making it less likely that any single IP will be blocked.
The botnet's geographic footprint shows most compromised nodes are located in the U.S. and Brazil, followed by Europe and Asia. According to Black Lotus Labs, the cluster in Brazil is reflective of the fact that 'we're seeing more and more botnets made up of Brazilian victims these days'. The present makeup of the botnet is significantly more diverse than previously, including devices from Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision, and Linksys, moving away from the previous focus on Cisco RV320 and RV325 routers. The architecture that powers the botnet is best described as layered, with operators using Tor nodes to manage infected infrastructure, including both the command-and-control (C2) and payload servers. This distributed approach enables the operators to distributing their scanning and reconnaissance activity across a wide range of IP addresses, making it less likely that any single IP will be labeled as a scanner and blocked.
China-nexus adversaries have significantly expanded their global targeting beyond the United States, with Australia and New Zealand now facing direct and growing supply chain risks from state-sponsored cyberattacks. According to CrowdStrike's 2026 Technology Threat Landscape Report released on June 9, China-nexus adversaries attacked the technology sector more than any other industry, stealing artificial intelligence (AI) capabilities and intellectual property (IP) that Beijing cannot build fast enough on its own. The cybersecurity firm tracked activity from April 2025 to March 2026, linking it to Beijing's drive for technological self-sufficiency and its stated goal of global AI leadership by 2030. The report reveals that over 58% of state-sponsored cyberattacks on tech companies, particularly those possessing AI assets, are emanating from China. As reported by CNBC, the activity was part of an effort to obtain strategic technology and narrow the AI gap with the United States.
As reported by CrowdStrike, AI capabilities rank as the highest-value intelligence collection target for China-nexus adversaries. Beijing can apply those capabilities to military modernization, economic growth, and intelligence gathering. The report explains that technology entities serve as strategic targets because access provides high-value intelligence collection and access to downstream customer environments that can enable potential supply chain compromises. According to Black Lotus Labs, JDY's evolution from a supporting component of the KV-botnet to an independent, high-performance reconnaissance capability demonstrates that disruption of individual nodes or clusters does not eliminate the underlying capability. The malware is designed to adapt its scanning methodology based on its privileges on the local system, initiating high-speed SYN scanning using custom-crafted TCP packets if it can open raw sockets, and using standard TCP and TLS connections or protocols like UDP and ICMP if raw sockets are unavailable. JDY's goal is to conduct infrastructure reconnaissance rather than exploitation, with the results sent to central servers for ongoing intelligence gathering to further Chinese threat actors' objectives.
Recent developments show the state of international cybersecurity has deteriorated significantly, with the Cybersecurity Tech Accord's 2026 Cybersecurity Thermometer reading 95 degrees Celsius, representing a worsening situation despite some positive developments. According to an advisory notice issued in April 2026 by cybersecurity agencies in 10 countries, including the UK, Germany, and the U.S., China-nexus cyber actors are now using large scale networks of compromised devices (covert networks) to carry out cyber attacks. A China-backed actor has infiltrated critical infrastructure in the U.S. such as aviation and water systems, while an assessment released by Finland's intelligence service in March 2026 stated that Russia and China continue to conduct extensive cyber espionage and influence operations targeting the country's technology sector. In Singapore, authorities announced in February 2026 that a China-linked group carried out a targeted campaign against all of the country's major telecommunications operators using advanced tools to infiltrate telecom networks and maintain long-term covert access.
Beyond state-sponsored espionage, the report found that 65% of interactive operations against the sector were financially motivated, with 572 technology organizations named on extortion leak sites and 277 having their access advertised by initial access brokers — a roughly 30% increase. The report highlights that technology is now the most-targeted industry globally, with attackers increasingly weaponizing the AI ecosystem itself. CrowdStrike documented incidents in which eCrime actors exploited AI adoption through fake 'OpenClaw' skills in February 2026, while the firm also flagged supply chain attacks as a growing vector. STARDUST CHOLLIMA, another DPRK-nexus group, compromised the Axios NPM package — an open-source library downloaded approximately 100 million times per week — likely exposing millions of downstream applications and users. The report also highlighted activity linked to North Korea, with CrowdStrike saying North Korean-affiliated operatives continued efforts to secure employment inside technology companies using false identities and AI-enhanced personas.
The report's findings have generated significant market interest, with CrowdStrike shares rising 1.6% to $655.45 on the day of publication, giving the company a market capitalization of approximately $167 billion. The stock is up roughly 40% year-to-date, though it remains about 17% below its 52-week high of $785.66. The findings add a cybersecurity dimension to the ongoing U.S.-China technology rivalry, with Washington having imposed successive rounds of export controls on advanced semiconductors and AI chips while Beijing has accelerated domestic AI development programs. The report arrives amid heightened tensions over technology competition, with the findings likely to intensify pressure on U.S. policymakers and technology companies to harden defenses around AI training data, model weights, and related infrastructure. The Five Eyes intelligence alliance recently issued a joint alert about what it described as an expanding Chinese espionage threat, warning that Chinese intelligence services have increasingly used online recruitment platforms and professional networking sites to approach individuals with access to sensitive government, military, and technology-related information.
