Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
17 IOCs
Github Yankywilson/jdy Botnet Threat Analysis: Defensive Cti Analysis of the Jdy Reconnaissance Botnet (china Nexus, Volt Typhoon / Kv Lineage, Mitre G1017): Mips64 Implant Reverse Engineering, Infrastructure Enumeration, Tiered Intelligence Reporting, Sigma/yara Detections, and a Tasking Decryptor. Tlp:clear.
Threat Actors
Malware Families
Excerpt
https://github.com/yankywilson/jdy-botnet-threat-analysis GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR. By yankywilson Archived: 2026-10-10 02:00:39 UTC A complete defensive analysis of the JDY botnet: reverse…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →17 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | investigation_methodology.md | High | Score 67/100 | First seen |
| Domain | operational_intelligence_report.md | High | Score 67/100 | First seen |
| Domain | strategic_intelligence_report.md | High | Score 67/100 | First seen |
| SHA256 | 40ad28b87b5ed395fe8ff303555cc28974682ed6cc5a71ede76c4b17648cb8ed | High | Score 86/100 | First seen |
| Domain | jdy_iocs.md | High | Score 67/100 | First seen |
| Domain | tactical_intelligence_report.md | High | Score 67/100 | First seen |
| Domain | threat_hunting_guide.md | High | Score 67/100 | First seen |
| Domain | jdy_decrypt.py | High | Score 67/100 | First seen |
| Domain | reverse_engineering.md | High | Score 67/100 | First seen |
| Domain | corrections_log.md | High | Score 67/100 | First seen |
| Domain | infrastructure_enumeration.md | High | Score 67/100 | First seen |
| Domain | jdy_network_cert_notes.md | High | Score 67/100 | First seen |
| Domain | implant_components_re.md | High | Score 67/100 | First seen |
| Domain | incident_response_playbook.md | High | Score 67/100 | First seen |
| Domain | non_discriminating_selectors.md | High | Score 67/100 | First seen |
| Domain | technical_writeup.md | High | Score 67/100 | First seen |
| Domain | readme.md | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…