Loading malware…
KV-botnet is a malware-enabled network of compromised small-office/home-office routers, firewall appliances, and other internet-connected devices used by China-linked state-sponsored actors, including Volt Typhoon. It provides covert traffic relay and data-transfer infrastructure that conceals the origin of espionage operations against U.S. critical infrastructure, including communications, energy, water, and transportation systems. Compromised devices are distributed worldwide and include Cisco and Netgear equipment, with end-of-life routers prominent among devices disrupted in the United States. Devices are enrolled through exploitation of internet-exposed vulnerabilities.
The KV malware operates entirely in memory and lacks a persistence mechanism. Rebooting an infected device removes the malware, but operators can regain access by exploiting the device again. The broader botnet included functionally distinct clusters: the main KV cluster supported covert communications, while JDY performed internet scanning and reconnaissance. JDY subsequently continued operating as an independent reconnaissance network.
In December 2023, the FBI conducted a court-authorized operation that remotely removed KV malware from hundreds of U.S. routers; the operation was announced in January 2024. Operators responded with concentrated re-exploitation attempts against thousands of exposed devices, particularly Netgear ProSAFE appliances. Law-enforcement action and subsequent infrastructure blocking substantially disrupted the main KV cluster, which was assessed as no longer effectively active by January 2024, without eliminating the separately tracked JDY capability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
US authorities disrupted the KV-botnet, an earlier network of compromised routers that Volt Typhoon used to hide its activity.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
...used a covert network of connected devices to burrow deep into critical US networks and preposition for future destructive attacks.
The cluster designated “JDY” was primarily used to perform mass internet scanning, presumably for reconnaissance.
APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure... APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment... HAFNIUM has operated from leased virtual private servers (VPS) in the United States.
Resource Development: In observed attacks, Volt Typhoon exploits End of Life (EoL) Cisco and NETGEAR SOHO routers to use as proxies for Command and Control infrastructure These devices are infected with the KV Botnet malware
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
The JDY botnet is back and expanding via attacks on unpatched routers, cameras and other edge devices... JDY botnet now makes up 1,500 compromised small office and home office (SOHO) devices, as well as edge and Internet of Things (IoT) devices.
T1584.008 Compromise Infrastructure: Network Devices — Devices are compromised and added to botnets
Over a three-day period from December 8 to December 11, 2023, KV-botnet operators targeted approximately 33% of the NetGear ProSAFE devices on the Internet for re-exploitation, a total of 2,100 individual devices.
As documented in the malware analysis section of our initial report, the KV malware resides completely in-memory and therefore did not have a persistence mechanism.
We can assume the FBI began issuing commands to the bots to remove the malware and enhance protective measures of the previously infected devices sometime on or after December 6.
As documented in the malware analysis section of our initial report, the KV malware resides completely in-memory and therefore did not have a persistence mechanism.
The “JDY” cluster, principally used for scanning potential targets, fell silent for roughly fifteen days following our report.
Volt Typhoon ... has primarily targeted outdated Cisco and Netgear routers to be part of its KV Botnet.
KV-botnet: ... a covert data transfer network used by state-sponsored actors based in China to conduct espionage and intelligence activities targeting U.S. critical infrastructure.
We observed a brief but concentrated period of exploitation activity in early December 2023, as the threat actors attempted to re-establish their command and control (C2) structure and return the botnet to working order.
These compromised devices associated with the KV-cluster were chained together to form a covert data transfer network supporting various Chinese state-sponsored actors including Volt Typhoon.
higher-end threat actors will compromise opportunistic, seemingly random endpoints wherever they can be found to build out proxy networks of hosts to channel and obfuscate subsequent operations.
In December 2023, the US Federal Bureau of Investigation (FBI) conducted a court-authorized disruption of the KV Botnet, by running a remote uninstall of infected systems in the United States.
JDY was first spotted back in 2023 as part of an investigation into the KV botnet, which was used for covert data transfer while JDY was focused on scanning and reconnaissance.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.