Volt Typhoon rebuilds malware botnet following FBI disruption

There has recently been a rise in the botnet activity created by the Chinese threat group Volt Typhoon, which leverages similar techniques and infrastructure as those previously created by the group. SecurityScorecard reports that the botnet has recently made a comeback and is now active again.

It was only in May of 2023 that Microsoft discovered that the Volt Typhoon was stealing data from critical infrastructure organizations in Guam, which it linked to the Chinese government. This knowledge came as a result of a spy observing the threat actor stealing data from critical infrastructure organizations on US territory. 

Several Cisco and Netgear routers have been compromised by Chinese state-backed cyber espionage operation Volt Typhoon since September, to rebuild its KV-Botnet malware, which had previously been disrupted by the FBI and was unsuccessfully revived in January, reports said.

A report by Lumen Technologies’ Black Lotus Labs released in December 2023 revealed that outdated devices mostly powered Volt Typhoon’s botnet from Cisco, Netgear, and Fortinet. 

The botnet was used to transfer covert data and communicate over unsecured networks.

The US government recently announced that the Volt Typhoon botnet had been neutralized and would cease to operate. Leveraging the botnet’s C&C mechanisms, the FBI remotely removed the malware from the routers and changed the router’s IP address to a port that is not accessible to the botnet. 

Read the original article:

Volt Typhoon rebuilds malware botnet following FBI disruption