More than 1,500 compromised routers and IoT devices are now tied to a surviving cluster of a botnet once dismantled by U.S. law enforcement, and the same set of actors is showing up in tangled influence campaigns and recruitment scams, according to multiple reports released this week.
Lumen’s Black Lotus Labs: JDY cluster has surged
Lumen’s Black Lotus Labs reported a “significant resurgence” tied to a botnet family previously associated with China-nexus actors such as Volt Typhoon. The firm said that while the KV cluster of the KV-botnet became largely defunct after an FBI takedown in January 2024, the JDY cluster “remains an active threat, and has since surged to more than 1,500 compromised routers and IoT devices.”
Black Lotus Labs added: “Analysis of this activity shows a clear focus on identifying vulnerable infrastructure shortly after public vulnerability disclosures, suggesting that reconnaissance output is rapidly operationalized by China-nexus advanced persistent threat (APT) actors.” The threat intel team said the activity targeted a range of sectors, with “the US military and associated entities as the most prominent.”
KV-botnet background: clusters and roles
The FBI previously announced in January 2024 that it had “killed” Volt’s KV-botnet, which at that time comprised hundreds of end-of-life routers and other internet-connected devices. The botnet was organized into four clusters: the KV cluster was primarily used as a covert data transfer network, and the JDY cluster was used for scanning and reconnaissance. Lumen’s findings indicate the JDY cluster has outlived the disruption aimed at KV.
OpenAI takedowns: ChatGPT used to draft influence content about datacenters and policy
OpenAI said it banned ChatGPT accounts likely originating from China after operators used its models to generate content for covert operations about American AI and datacenters. Ben Nimmo, principal investigator on OpenAI’s Intelligence and Investigations team, told reporters: “Neither campaign appears to have gained much authentic engagement. They're important for what they reveal about the intentions of influence operators from China and the narratives they're testing and seeking to amplify.”
OpenAI described two clusters of accounts. The first used ChatGPT to produce social media text and images advancing a narrative that datacenters and AI applications are driving up electricity demand and costs for ordinary Americans — for example, by asking for “comic strips about a power grid operator’s capacity auction prices based on reporting from a legitimate regional paper” and instructing the model to frame rising capacity prices as a consequence of peak electricity demand from data centers and AI applications. Operators then posted comments and images on X, likely using fake accounts, with links to real news stories about datacenters.
OpenAI “suspects the operators are part of a social-media team at a private Chinese tech company that provides services for Chinese provincial-level government clients.” Nimmo summarized the intent succinctly: “This was not a case of an influence operation creating a debate. The debate existed already. This was an influence operation from China trying to interfere in it. We didn't see any signs that they succeeded.”
The second cluster used OpenAI models to write comments and draw political cartoons criticizing U.S. tech policies and tariffs. Operators specified prompts that should not include cartoons of Xi Jinping and should only include President Trump; they wrote prompts in simplified Chinese and used VPNs to access the AI systems. Those accounts also used ChatGPT to edit work reports and help design social media monitoring systems. Nimmo observed: “This isn't the first time that we've seen actors in China trying to come up with ideas for social media monitoring.” OpenAI previously said in February that it had banned ChatGPT accounts believed linked to Chinese government entities attempting to use AI models to surveil individuals and social media accounts.
DOJ seizure: 13 fake consulting sites used to recruit and bribe
The U.S. Department of Justice obtained a warrant and seized 13 fake consulting company websites alleged to have been used to target U.S. persons, including current and former security clearance holders. The domains listed in court filings include centrikglobalconsulting.com, rightinfoconsult.com, finnaclevesperconsulting.com, cydfconsulting.com, pulsewaveglobal.com, catalystglobalsolutions.com, thehorizzen.com, geoindopacific.com, gpf-ina.org, safesec-group.com, thetruthinfo.com, Vandercons.com, and gulfpeace.org.
According to the court documents, since November 2023 these sites and associated job postings on social media, LinkedIn, and other hiring platforms advertised roles such as “Senior Analyst” and “International Affairs Consultant.” The DOJ alleges suspected PRC operatives used the postings to recruit applicants and bribe them for sensitive information, paying recruits through online accounts in the names of fictitious individuals and via cryptocurrency. The filings state: “The conspirators have encouraged applicants and recruits to share confidential and sensitive information in violation of their official duties and of particular interest to the People's Republic of China (PRC) government” and that “The recruiters pressured candidates to share confidential information and reports from ‘insider sources' in violation of their official duties.”
How the US military, enterprises, and security-clearance holders should view this
- US military and associated entities: Black Lotus Labs places these organizations among the most prominent targets; they will face heightened reconnaissance tied to newly disclosed vulnerabilities and should treat JDY activity as an ongoing operational reconnaissance risk.
- Enterprises and security teams: Lumen recommends implementing CISA and NCSC guidance for mitigating Volt Typhoon activity and defending against covert networks of compromised devices; the JDY surge underscores the need to patch quickly after public vulnerability disclosures and to harden unmanaged routers and IoT devices.
- Current and former security-clearance holders and hiring managers: The DOJ seizure highlights a continuing criminal pattern of fake consulting jobs and bribery tied to recruitment for sensitive information — vigilance about unsolicited offers and careful vetting of recruiters remain essential.
Taken together, the three threads reported this week — a revived reconnaissance cluster tied to a known botnet family, AI-facilitated influence operations that tested politically sharp narratives, and a DOJ seizure of fake job sites used to solicit secrets — sketch a multi-pronged approach by China-nexus actors that mixes cyber intrusion, generative-AI misuse, and human-targeting schemes. For defenders, the immediate tasks are concrete: follow the CISA and NCSC mitigations Lumen cites, monitor post-disclosure scanning, and treat unsolicited recruiting overtures with skepticism. For observers, Ben Nimmo’s assessment captures the essential tension: the campaigns “didn't see any signs that they succeeded,” yet their existence reveals intentions and testing that bear watching.
