KV Botnet Activity

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. KV Botnet Activity was used by Volt Typhoon to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.(Citation: Lumen KVBotnet 2023) This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.(Citation: DOJ KVBotnet 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Volt Typhoon

Attribution confidence

Not established

First documented activity

2022-10-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-10-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-01-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1685 · Disable or Modify Tools

  Defense Impairment — KV Botnet Activity used various scripts to remove or disable security tools, such as <code>http_watchdog</code> and <code>firewallsd</code>, as well as tools related to other botnet infections, such as <code>mips_ff</code>, on victim devices.(Citation: Lumen KVBotnet 2023)

• T1016 · System Network Configuration Discovery

  Discovery — KV Botnet Activity gathers victim IP information during initial installation stages.(Citation: Lumen KVBotnet 2023)

• T1057 · Process Discovery

  Discovery — Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.(Citation: Lumen KVBotnet 2023)

• T1584.008 · Network Devices

  Resource Development — KV Botnet Activity focuses on compromise of small office-home office (SOHO) network devices to build the subsequent botnet.(Citation: Lumen KVBotnet 2023)

• T1105 · Ingress Tool Transfer

  Command And Control — KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.(Citation: Lumen KVBotnet 2023)

• T1583.003 · Virtual Private Server

  Resource Development — KV Botnet Activity used acquired Virtual Private Servers as control systems for devices infected with KV Botnet malware.(Citation: Lumen KVBotnet 2023)

• T1055.009 · Proc Memory

  Stealth, Privilege Escalation — KV Botnet Activity final payload installation includes mounting and binding to the <code>\/proc\/</code> filepath on the victim system to enable subsequent operation in memory while also removing on-disk artifacts.(Citation: Lumen KVBotnet 2023)

• T1095 · Non-Application Layer Protocol

  Command And Control — KV Botnet Activity command and control traffic uses a non-standard, likely custom protocol for communication.(Citation: Lumen KVBotnet 2023)

• T1059.004 · Unix Shell

  Execution — KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.(Citation: Lumen KVBotnet 2023)

• T1222.002 · Linux and Mac Permissions

  Defense Impairment — KV Botnet Activity altered permissions on downloaded tools and payloads to enable execution on victim machines.(Citation: Lumen KVBotnet 2023)

• T1036.004 · Masquerade Task or Service

  Stealth — KV Botnet Activity installation steps include first identifying, then stopping, any process containing <code>[kworker\/0:1]</code>, then renaming its initial installation stage to this process name.(Citation: Lumen KVBotnet 2023)

• T1070.004 · File Deletion

  Stealth — KV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.(Citation: Lumen KVBotnet 2023)

• T1573 · Encrypted Channel

  Command And Control — KV Botnet Activity command and control activity includes transmission of an RSA public key in communication from the server, but this is followed by subsequent negotiation stages that represent a form of handshake similar to TLS negotiation.(Citation: Lumen KVBotnet 2023)

• T1036 · Masquerading

  Stealth — KV Botnet Activity involves changing process filename to <code>pr_set_mm_exe_file</code> and process name to <code>pr_set_name</code> during later infection stages.(Citation: Lumen KVBotnet 2023)

• T1564.013 · Bind Mounts

  Stealth — KV Botnet Activity leveraged a bind mount to bind itself to the `/proc/` file path before deleting its files from the `/tmp/` directory.(Citation: Lumen KVBotnet 2023)

• T1546 · Event Triggered Execution

  Privilege Escalation, Persistence — KV Botnet Activity involves managing events on victim systems via <code>libevent</code> to execute a callback function when any running process contains the following references in their path without also having a reference to <code>bioset</code>: busybox, wget, curl, tftp, telnetd, or lua. If the <code>bioset</code> string is not found, the related process is terminated.(Citation: Lumen KVBotnet 2023)

• T1571 · Non-Standard Port

  Command And Control — KV Botnet Activity generates a random port number greater than 30,000 to serve as the listener for subsequent command and control activity.(Citation: Lumen KVBotnet 2023)

• T1083 · File and Directory Discovery

  Discovery — KV Botnet Activity gathers a list of filenames from the following locations during execution of the final botnet stage: <code>\/usr\/sbin\/</code>, <code>\/usr\/bin\/</code>, <code>\/sbin\/</code>, <code>\/pfrm2.0\/bin\/</code>, <code>\/usr\/local\/bin\/</code>.(Citation: Lumen KVBotnet 2023)

• T1082 · System Information Discovery

  Discovery — KV Botnet Activity includes use of native system tools, such as <code>uname</code>, to obtain information about victim device architecture, as well as gathering other system information such as the victim's hosts file and CPU utilization.(Citation: Lumen KVBotnet 2023)

• T1518.001 · Security Software Discovery

  Discovery — KV Botnet Activity involved removal of security tools, as well as other identified IOT malware, from compromised devices.(Citation: Lumen KVBotnet 2023)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0035

  Official MITRE ATT&CK campaign record C0035. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.