Episode
The botnet that scouts before it strikes. [Research Saturday]
- Podcast
- CyberWire Daily
- Published
- Aug 15, 2026
- Duration seconds
- 1633
- Processing state
not_requested- Canonical source
- https://thecyberwire.com/podcasts/research-saturday/437/notes
Actions
POST https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/the-botnet-that-scouts-before-it-strikes-research-saturday/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cyberwire-daily-454880/the-botnet-that-scouts-before-it-strikes-research-saturday.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Today we are joined by Ian Goldin, Senior Lead Information Security Engineer, and Mike Horka, Principal Information Security Engineer, from Lumen's Black Lotus Labs, discussing their research entitled "Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation." Black Lotus Labs has uncovered a major resurgence of the JDY botnet, a China-nexus reconnaissance network now comprising more than 1,500 compromised SOHO and IoT devices. The botnet uses these devices to conduct targeted scanning and fingerprinting, helping threat actors rapidly identify vulnerable infrastructure—sometimes within hours of a new vulnerability disclosure—and appears to have a particular focus on U.S. military-related networks. The research highlights how compromised routers and IoT devices can be turned into distributed reconnaissance infrastructure that evades traditional IP-based defenses and supports follow-on exploitation. The research and executive brief can be found here: Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation