MITRE ATT&CKcampaign

C0035 KV Botnet Activity

Published 2024-06-10 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2024-06-10

Description

KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. KV Botnet Activity was used by Volt Typhoon to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster. This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.

Related

Attributed to · MITRE ATT&CK (1)

  • G1017 Volt Typhoon group

Uses · MITRE ATT&CK (20)

  • T1685 Disable or Modify Tools technique
  • T1564.013 Bind Mounts sub-technique
  • T1584.008 Network Devices sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1573 Encrypted Channel technique
  • T1571 Non-Standard Port technique
  • T1059.004 Unix Shell sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1222.002 Linux and Mac Permissions sub-technique
  • T1070.004 File Deletion sub-technique
  • T1546 Event Triggered Execution technique
  • T1055.009 Proc Memory sub-technique
  • T1016 System Network Configuration Discovery technique
  • T1036 Masquerading technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique

References