Volt Typhoon's KV-Botnet

Verticals Targeted: Government

Executive Summary

Volt Typhoon was observed compromising Cisco RV325 devices with KV-Botnet.

Key Takeaways

• Volt Typhoon was observed compromising Cisco RV325 with KV-Botnet. 
• Volt Typhoon, also known as Bronze Silhouette, is an espionage-focused China nexus state sponsored threat actor group. 
• The threat actors appeared to be targeting government entities in the US, UK, and Australia. 
• The group was also observed using previously unidentified infrastructure and a previously unspecified webshell. 

What is KV-Botnet?

Volt Typhoon was observed compromising Cisco RV325 devices with KV-Botnet. SecurityScorecard reported on this activity. The threat actors appeared to be targeting government entities in the US, UK, and Australia.

KV-Botnet is an extensive botnet consisting of firewalls and routers. It is used for covert data transfer, likely for espionage purposes. The threat actors have been using KV-Botnet since at least 2022.

Volt Typhoon reportedly compromised 30% of Cisco RV325 in 37 days. The group likely leveraged either CVE-2019-1653 or CVE-2019-1652 to compromise the devices. It is important to note that the Cisco RV325 devices have reached end of life, meaning Cisco no longer offers support for the devices and there will be no software updates to address the security issues.

SecurityScorecard researchers also discovered previously unidentified infrastructure used by the threat actors, as well as a previously unspecified webshell, known as fy.sh, on devices targeted by Volt Typhoon.

Black Lotus Labs recently reported on KV-Botnet as well and assessed that Volt Typhoon was likely developing new infrastructure for upcoming attacks. According to Black Lotus Labs, Volt Typhoon was also observed targeting DrayTek, Fortinet, and Netgear devices with KV-Botnet. They noted other China nexus threat actors may also be using KV-Botnet.

Who is Volt Typhoon?

Volt Typhoon, also known as Bronze Silhouette, is an espionage-focused China nexus state-sponsored threat actor group. The group has been active since at least 2021. Volt Typhoon is known to use LoLbins and web shells in their attacks. In 2023, Volt Typhoon was observed targeting US critical infrastructure. Targets included critical structure entities in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education verticals. The US Navy was among the group’s victims. 

IOCs

PolySwarm has multiple samples of KV-Botnet.

88fc3816c94f9b0191179f4e933843ee4cfdbcb392968605491a387b1235ec12

6a8230e66011e0a0012273f7d12110c23b1e33bd7232dc67a836662a3d1075c7

5a2681ea2e1d0d5e7db2a2499d2e6e27b2689830c638d5ee28c2eef9867ececf

9e6a2a01decc2c26f3586a119b6fd3a886c4cf9c76aa452339d164fda40c63e4

07118af421f14a7e07601639f44a72f6782757ae74d2afffdb531b8209697e7f

c524e118b1e263fccac6e94365b3a0b148a53ea96df21c8377ccd8ec3d6a0874

c71d04e2b6b35fdd058b4be5cf9ea3478697950378d4ee3c7fe0bf87e1e3730f

2711f1341d2f150a0c3e2d596939805d66ba7c6403346513d1fc826324f63c87

bf0ed245e897c7d1ada511db2939e8f3a879a96543f2651d5631339d5419bb75

19aa5a2235ee2518826a48363cb603060ee73ddccdf7d93bf197f97d7402aa37

8e35d8643c00d9e2993625b03366a7cd1bd36e6a60bc0c6039a509fccf9df150

f5271fcb895977dc1eead64415e525323cd412e3f2625aee2fafbb5674beea28

48299c2c568ce5f0d4f801b4aee0a6109b68613d2948ce4948334bbd7adc49eb

36c63d0c2a78497ccf555e84f0233a514943faeff38281d99d00baf5df23f184

08d0da0c36089f7a1f700b989f2f7825c5ba2549a20735d0bd1e64ca9c4885bc

c0871ecfe8b306074c6d376db14d966578a8511e5b5d355a4cf2c4d0b8c9deb9

b6226c3e0e4ad64bbda3e6a79eb464c7050faa25d1f5332dcac014d2e79dd87f

0279435f8727cca99bee575d157187787174d39f6872c2067de23afc681fe586

3fab16ec4643d8f6b9a99d85427322f7fb40e9ea3cd4de8318c6a52e29869d5a

86f01d5342ec39c65b1cff716f19c334cec26a82b87492d783d5e8f4ff9cb63a

d6cd1636569bba4131462bb8f45be1daa9a203aa343b6f2fd48a4847acfc29fa

b4f2470159ca93f9d585ae2df1da972f6d14a0c418ebc202a324b9be5c877b61

2cb6df289475457e807fc202a2b4688b2e23a88c94a8431981780caf8b76acf7

You can use the following CLI command to search for all KV-Botnet samples in our portal:

$ polyswarm link list -f KV-Botnet

You can use the following CLI command to search for all VoltTyphoon samples in our portal:

$ polyswarm link list -t VoltTyphoon

Don’t have a PolySwarm account? Go here to sign up for a free Community plan or to subscribe.

Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.