JDY Botnet CVE-2026-35616 Exploitation Followed by MIPS Dropper Download

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.