JDY/KV-Botnet Node C2 Re-registration via Tor Ports Post-Takedown

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects potential beaconing or re-registration activity associated with the JDY/KV-botnet by monitoring network connections to known Tor control/relay ports (9001 and 9050). The detection identifies endpoints making high-volume, multi-destination connections to external IPs over these specific ports, a pattern indicative of botnet nodes attempting to re-establish C2 communication after infrastructure disruption or actively recruiting new nodes.