Sly Chinese Hackers Snatch Outdated Routers for Stealth Data Trade

Key Points:

• Volt Typhoon, also known as Bronze Silhouette, has been found to be associated with a complex botnet referred to as the “KV-botnet.”
• This entity has been targeting SOHO routers since a minimum of February 2022 primarily for proxying malicious traffic.
• According to data from Microsoft and the US government, this actor is establishing infrastructure to hinder communications between the USA and Asia in potential future conflicts.
• IP addresses used for the campaign were reportedly traced back to the People’s Republic of China, with operations occurring during Chinese Standard Time working hours, adding further proof to the origin of the threat actor.
• The botnet specifically targets end-of-life devices utilized by SOHO entities due to their low security and high ease of exploitability, such as Cisco RV320s, DrayTek Vigor routers, and NETGEAR ProSAFE firewalls.

The botnet’s operation is split into two distinct activities; the less sophisticated “JDY cluster,” which scans for targets, and the “KV cluster,” which is reserved for manual operations against high-profile targets. The threat actor typically uses several files, including a bash script file, at various points in their infection chain. This could include ceasing specific processes and eliminating security tools that usually operate on the compromised devices.

As part of the evasion techniques used, the botnets are set up with random ports for C2 communication. They also mimic their names as existing processes to further disguise their activities. The actors communicate with these botnets to perform several illicit activities, including data exfiltration, data transmission, creation of network connections, and task executions, among others.

A complete report detailing the botnet infection chain, process execution, attack methods, evasion techniques, among other information, has been published. Although this report does not explicitly mention it, this issue underlines the importance of keeping devices and security systems updated to thwart such threats.