JDY Botnet Node Reconstitution: Tor C2 Check-in Combined with High-Rate Port Scanning

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects internal hosts initiating connections to known Tor ORPort or DirPort services, indicating potential C2 check-in, correlated with high-rate scanning behavior from the same source IP. This combination suggests a compromised host using an anonymity network for C2 communication while simultaneously performing internal reconnaissance.