Log in Request a demo

Malware profile

KV botnet

Also known as KV Botnet Activity

KV Botnet is malware that took over small office and home office routers and linked them into a botnet.

In short

KV Botnet is malware that took over small office and home office routers and linked them into a botnet. The US Department of Justice says Chinese state-sponsored hackers used it to hide where their attacks on critical infrastructure came from. A court-authorized operation disrupted it in December 2023, and the US announced this on 31 January 2024.

Last updated 9 October 2026

Profile MapMalware
  1. Names2names in public reportsKV botnet · KV Botnet Activity
  2. Linked Groups1groups that use itVolt Typhoon

In one minute

What it is
Malware that turned small office and home office (SOHO) routers into a botnet, mostly old Cisco and NetGear models.
What it does
Routers in the botnet acted as relay points that hid the origin of other hacking activity. A court-authorized operation deleted the malware from hundreds of US routers.
Who uses it
Attributed by the US Department of Justice, on 31 January 2024, to People's Republic of China state-sponsored hackers known as Volt Typhoon. CISA, NSA and the FBI repeated this link on 7 February 2024.
How it gets in
Routers that had reached end of life and no longer received security patches, according to the Department of Justice.
What to do first
Find and replace any router that is past its support date, and do not expose router management pages to the internet.

What it does

The routers in the botnet worked as relay points. According to the US Department of Justice, the hackers used them to conceal the Chinese origin of further hacking activity against victims in the United States and elsewhere.

MITRE tracks this as the campaign "KV Botnet Activity". It says the campaign mainly exploited end-of-life routers from makers such as Cisco, NETGEAR and DrayTek, and that it overlaps with another botnet cluster called the JDY cluster.

MITRE ATT&CK links the same actor, Volt Typhoon, to a later tool for Versa Director servers: VersaMem.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
KV botnetUS Department of Justice press release of 31 January 2024 and CISA advisory AA24-038A, which write "KV Botnet"[3, 4]
KV Botnet ActivityName of the MITRE ATT&CK campaign C0035 that covers this botnet[1]

How it spreads

The Department of Justice says the vast majority of routers in the botnet were Cisco and NetGear models that were vulnerable because they had reached end of life and no longer got security patches. CISA and the FBI say Volt Typhoon actors are exploiting security defects in SOHO routers, and that many routers expose their web management pages to the public internet by default. No source we found states the exact steps of infection.

Timeline

  1. October 2022

    Botnet activity begins

    MITRE gives October 2022 as the first-seen date of the KV Botnet Activity campaign.[1]

  2. May 24, 2023

    Joint advisory AA23-144A

    CISA, the FBI, NSA and partners warned that the actor, also known as Volt Typhoon, used compromised SOHO network devices as intermediate infrastructure to hide its activity.[6]

  3. December 2023

    Court-authorized operation

    The Department of Justice says a court-authorized operation in December 2023 disrupted a botnet of hundreds of US-based SOHO routers.[3]

  4. January 2024

    Last activity MITRE lists

    MITRE lists January 2024 as the last-seen date and says US law enforcement disrupted the botnet in early 2024.[1]

  5. January 31, 2024

    Disruption announced

    The Department of Justice announced the operation. On the same date CISA and the FBI published a Secure by Design alert urging SOHO router makers to fix the defects that Volt Typhoon exploits.[3, 5]

  6. February 7, 2024

    Advisory AA24-038A

    CISA, NSA and the FBI said recent Volt Typhoon operations used end-of-life Cisco and NETGEAR SOHO routers implanted with KV Botnet malware.[4]

Detection and defense

  1. Replace end-of-life routers

    The FBI strongly encourages owners to remove and replace any end-of-life SOHO router. The Department of Justice says a restart alone, without similar mitigation steps, leaves a cleaned router open to reinfection.[3]

  2. Plan for end of life

    AA24-038A advises keeping an asset inventory so equipment beyond its supported life can be found, then adding scanning, isolation, segmentation and replacement plans.[4]

  3. Keep management pages off the internet

    CISA and the FBI say router management interfaces should sit on LAN side ports, and advisory AA23-144A says SOHO owners should not expose network management interfaces to the internet.[5, 6]

  4. Patch exposed devices

    AA24-038A says to apply patches to internet-facing systems and to prioritize appliances Volt Typhoon is known to exploit, including NETGEAR and Cisco devices.[4]

  5. Use phishing-resistant MFA and change default passwords

    AA24-038A lists both as mitigations against Volt Typhoon activity.[4]

  6. Use the official resources

    Read AA24-038A and AA23-144A for mitigations and hunting guidance. The Department of Justice press release links the Volt Typhoon Malware Analysis Report. If you think a router is compromised, report it to the FBI Internet Crime Complaint Center or to CISA.[3, 4, 6]

Questions

What is the KV botnet?

The US Department of Justice describes it as a botnet of hijacked SOHO routers infected with "KV Botnet" malware, used by Chinese state-sponsored hackers known as Volt Typhoon to conceal the origin of further hacking.

Which routers were affected?

The Department of Justice says the vast majority were Cisco and NetGear routers that had reached end of life. MITRE also names DrayTek as a maker of equipment exploited in the campaign.

Was the botnet shut down?

The Department of Justice says a court-authorized operation in December 2023 deleted the malware from the routers and cut their link to the botnet. It says the steps were temporary and a restart without further mitigation can leave a router open to reinfection.

Did the operation affect router owners?

The Department of Justice says the operation did not affect the legitimate functions of the routers or collect content information from them. The FBI says it is providing notice to owners of the infected routers it accessed.

What should router owners do?

The FBI strongly encourages owners to remove and replace any end-of-life SOHO router.

In our research

  1. Volt Typhoon advisory AA24-038A: what CISA says October 2026
  2. Living off the Land: The Cyberattack You’ll Never See Coming June 2025
  3. Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices March 2022
  4. Volt Typhoon Threat group
  5. Botnet Glossary term

Sources

  1. KV Botnet Activity, Campaign C0035 MITRE ATT&CKSupports: Campaign description, models affected, Volt Typhoon link, October 2022 to January 2024 dates, JDY overlap.
  2. Volt Typhoon, Group G1017 MITRE ATT&CKSupports: Group description, link to the KV botnet, use of compromised SOHO routers as proxies.
  3. U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure US Department of JusticeSupports: Court-authorized operation, router types, FBI statements, advice to replace end-of-life routers.
  4. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, AA24-038A CISA, NSA, FBI and partnersSupports: KV Botnet malware on end-of-life Cisco and NETGEAR routers, proxy use, mitigations.
  5. Secure by Design Alert: Security Design Improvements for SOHO Device Manufacturers CISA and FBISupports: Volt Typhoon targeting of SOHO routers, request to manufacturers.
  6. People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection, AA23-144A CISA, NSA, FBI and partnersSupports: May 2023 advisory, compromised SOHO devices as intermediate infrastructure.
  7. Secure by Design Alert (PDF): Security Design Improvements for SOHO Device Manufacturers CISA and FBISupports: Routers often ship with management interfaces exposed to the internet by default.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Botnet

A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks.

Read more

Glossary term

Critical infrastructure

Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.

Read more