Sly Chinese Hackers Snatch Outdated Routers for Stealth Data Trade

December 14, 2023
1 min read

Key Points:

  • Volt Typhoon, also known as Bronze Silhouette, has been found to be associated with a complex botnet referred to as the “KV-botnet.”
  • This entity has been targeting SOHO routers since a minimum of February 2022 primarily for proxying malicious traffic.
  • According to data from Microsoft and the US government, this actor is establishing infrastructure to hinder communications between the USA and Asia in potential future conflicts.
  • IP addresses used for the campaign were reportedly traced back to the People’s Republic of China, with operations occurring during Chinese Standard Time working hours, adding further proof to the origin of the threat actor.
  • The botnet specifically targets end-of-life devices utilized by SOHO entities due to their low security and high ease of exploitability, such as Cisco RV320s, DrayTek Vigor routers, and NETGEAR ProSAFE firewalls.

The botnet’s operation is split into two distinct activities; the less sophisticated “JDY cluster,” which scans for targets, and the “KV cluster,” which is reserved for manual operations against high-profile targets. The threat actor typically uses several files, including a bash script file, at various points in their infection chain. This could include ceasing specific processes and eliminating security tools that usually operate on the compromised devices.

As part of the evasion techniques used, the botnets are set up with random ports for C2 communication. They also mimic their names as existing processes to further disguise their activities. The actors communicate with these botnets to perform several illicit activities, including data exfiltration, data transmission, creation of network connections, and task executions, among others.

A complete report detailing the botnet infection chain, process execution, attack methods, evasion techniques, among other information, has been published. Although this report does not explicitly mention it, this issue underlines the importance of keeping devices and security systems updated to thwart such threats.

Latest from Blog

MediSecure hacked with massive ransomware data breach

Summary of ‘MediSecure hit by large-scale ransomware data breach’ TLDR: MediSecure, an Australian prescriptions provider, was hit by a large-scale ransomware attack. The incident is believed to have originated from one of

Equalizing cybersecurity for all

TLDR: A discussion on how organizations can enhance their cybersecurity posture with Blumira’s automated threat monitoring, detection, and response solutions. Blumira is working to lower the barrier to entry in cybersecurity for

Big cyber-attacks cost less now

Summary of Unexpectedly, the cost of big cyber-attacks is falling TLDR: Cybercrime costs are expected to rise to $23 trillion by 2027, according to Anne Neuberger Data shows that the economic impact