JDY Botnet MIPS Architecture-Detection Shell Dropper on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.