KV Botnet
KV Botnet is a covert botnet and data-transfer network associated with the PRC-linked threat actor Volt Typhoon and described by Black Lotus Labs as supporting China-based state-sponsored espionage and intelligence operations. It has been used to conceal the origin of follow-on intrusions and route malicious traffic through compromised devices, particularly against U.S. and other foreign victims, including critical infrastructure organizations in the communications, energy, water, and transportation sectors. Reporting states the botnet was built primarily from compromised small office/home office routers, especially end-of-life Cisco and NetGear devices, and in some descriptions also included other internet-connected equipment such as cameras and routers. The botnet used acquired virtual private servers as control systems for infected devices.
High-confidence reporting states the FBI conducted a court-authorized disruption in December 2023, remotely deleting KV Botnet malware from hundreds of infected U.S.-based SOHO routers and temporarily severing communications with botnet controllers without affecting legitimate router functions or collecting content. The malware was described as memory-resident and lacking persistence, so power cycling removed it but also left vulnerable devices open to reinfection unless mitigated or replaced. After the disruption, operators attempted to rebuild the botnet by re-exploiting devices between December 8 and December 11, 2023, with observed targeting of thousands of devices including large numbers of NetGear ProSAFE and Cisco RV320/RV325 systems. Black Lotus Labs later assessed the main KV cluster was likely rendered inert by January 2024 due to FBI action and continued null-routing, although related activity clusters such as JDY were observed separately.
The content consistently links KV Botnet to Volt Typhoon infrastructure and tradecraft, including use of compromised SOHO devices as relay nodes and proxy infrastructure to quietly tunnel into victim environments and obscure PRC attribution. Known infrastructure and device references directly mentioned in the content include end-of-life Cisco and NetGear routers, NetGear ProSAFE devices, Cisco RV320/RV325 routers, Axis IP cameras, DrayTek Vigor routers, and VPS-based control systems.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In a December 2023 operation, the FBI used the botnet's own command channel to delete the KV-botnet malware from hundreds of U.S. SOHO routers, mostly end-of-life Cisco and NetGear boxes that the China-linked Volt Typhoon was using to hide access it had planted ahead of a possible crisis inside American communications, energy, water, and transportation systems.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniques
Reconnaissance
Resource Development
4 techniques
Resource Development
APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure... APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment... HAFNIUM has operated from leased virtual private servers (VPS) in the United States.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
Initial Access
1 technique
Initial Access
Stealth
1 technique
Stealth
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
We observed a brief but concentrated period of exploitation activity in early December 2023, as the threat actors attempted to re-establish their command and control (C2) structure and return the botnet to working order.
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet listed among the top malware families affecting victims in Mexico in 2025.
Botnet malware deployed on compromised SOHO routers and used as an anonymizing relay infrastructure to conceal state-sponsored access and operations.
A botnet cluster previously hosting or associated with JDY before U.S. government disruption in early 2024.
KV-botnet is the larger botnet cluster within which JDY was initially identified before JDY evolved into an independent reconnaissance capability.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.