CVE-2026-35616 JDY Botnet: Architecture-Aware Shell Dropper Payload Download

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects malicious shell script execution on Linux edge/IoT devices associated with the JDY botnet exploitation of CVE-2026-35616. The rule identifies processes checking for MIPS-based architectures, using download utilities (wget, curl) for payload retrieval, and subsequent file deletion activity indicative of post-exploitation cleanup.