US Disrupts Volt Typhoon KV Botnet Built on Compromised SOHO Routers

The U.S. Department of Justice said a court-authorized FBI operation disrupted the KV Botnet, a network of hundreds of compromised small office and home office routers that the PRC-linked group Volt Typhoon used to mask follow-on intrusions against U.S. and foreign targets, including critical infrastructure. Officials said the botnet relied heavily on end-of-life Cisco and NetGear devices, and that the FBI removed malware from affected U.S.-based routers and severed communications with botnet controllers without disrupting legitimate router functions or collecting content. The government tied the activity to broader Chinese pre-positioning against sectors including communications, energy, transportation, and water, while warning that unsupported devices remain vulnerable to reinfection unless replaced or fully remediated.

Reporting on the takedown said the action mirrored earlier U.S. botnet disruptions such as the 2022 operation against Cyclops Blink, the Sandworm/GRU botnet that abused WatchGuard and ASUS devices as command-and-control infrastructure. Subsequent research from Censys found that KV Botnet control infrastructure evolved after the December 2023 disruption, with operators in the JDY cluster largely retaining the same infrastructure patterns while shifting hosting providers and continuing activity linked to vulnerable Cisco RV320/RV325 routers. The researchers said the botnet’s comparatively exposed infrastructure did not fully match Volt Typhoon’s usual stealthy tradecraft, raising questions about whether the KV Botnet was operated directly by Volt Typhoon or by a separate but related actor.