The 2024 action landed on the half of the operation that touched victims. Inside KV-botnet there were four clusters, the KV cluster running as a covert data transfer network and the JDY cluster doing scanning and reconnaissance [5]. Public disclosure plus US government takedown effort from late 2023 into early 2024 left KV largely defunct [6]. JDY stayed up [7]. The cluster that survived is the one whose entire function is sending packets at strangers' open ports, which is also the cheapest function in the set to rebuild.
The arithmetic shows how cheap. Black Lotus Labs put the January 2024 floor at roughly 650 bots talking to JDY command and control [8], and the current figure at more than 1,500 [2], which the researchers characterise as more than doubling since the takedown [14]. Subtract: at least 850 devices added [1]. Divide: a multiple of about 2.3 [2]. A router recruited to scan has to do less work, and survive less scrutiny, than a router carrying espionage traffic for an operator who needs it to stay quiet for months.
Separate what is measured from what is inferred. Lumen states the scanning shows a clear focus on identifying vulnerable infrastructure shortly after public vulnerability disclosures, and says this suggests reconnaissance output is rapidly operationalised by China-nexus APT actors [9]. Suggests is the researchers' word, and the published summary characterises the timing only in those terms, with no measured interval between a disclosure and the corresponding scan [13]. So the exposure window here is a scan cycle on infrastructure that is already standing and already funded, not a campaign someone has to spin up. Anyone converting that into a number of hours is filling in a blank the research left open.
The targeting is the part with a name attached. Activity spans a range of sectors, with US military and associated entities the most prominent [10]. For an organisation in that orbit, the useful assumption is that the fingerprint of its perimeter already exists in someone's triage queue, because JDY discovers, fingerprints and continuously maps exposed services and feeds the structured output into a larger scanning ecosystem for target identification [3]. Nothing in that chain requires a compromised device on your own network.
Which sets the cost boundary. You cannot patch another company's home router, and Black Lotus Labs frames the countermeasure as UK NCSC guidance on defending against China-nexus covert networks of compromised devices [11]. Two variables stay local: the edge inventory that gets recruited, and the gap between a disclosure and your own patch. Lumen has been tracking this category since Raptor Train and describes purpose-built reconnaissance infrastructure as a durable component of nation-state operations rather than an incident [12]. Takedowns have now demonstrated they can kill the transfer layer and leave the targeting layer counting your ports.
