New KV-Botnet Targeting Cisco, DrayTek, and Fortinet Devices for Stealthy Attacks

A new botnet consisting of firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR is being used as a covert data transfer network for advanced persistent threat actors, including the China-linked threat actor called Volt Typhoon.
Dubbed KV-botnet by the Black Lotus Labs team at Lumen Technologies, the malicious network is an amalgamation of two complementary activity

actor advanced advanced persistent threat attacks black lotus black lotus labs botnet called china cisco covert data data transfer devices draytek firewalls fortinet kv-botnet labs lumen lumen technologies malicious netgear network persistent persistent threat routers targeting team technologies threat threat actor threat actors transfer typhoon volt typhoon