JDY Botnet - Syslog/Access Log Deletion on Embedded Linux SOHO Devices

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects attempts to delete or clear Linux system logs using common utilities (rm, shred, truncate, echo, cat) targeting critical log paths such as /var/log/syslog, /var/log/messages, and other authentication or kernel logs. This activity is indicative of an adversary attempting to remove evidence of their actions from the local system.