JDY Botnet Linux Shell Payload Fetch or /tmp Execution on IoT/SOHO Device

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.