JDY Botnet: Mass Service Enumeration Scanning of SOHO Management Ports

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects high-volume outbound network connection attempts from internal endpoints targeting a specific set of common SOHO/IoT management and service ports. This behavior is consistent with automated service enumeration, banner grabbing, and reconnaissance activity often associated with botnets like the JDY cluster, which target edge devices for potential exploitation.