NEW KV-BOTNET TARGETING CISCO, DRAYTEK, AND FORTINET DEVICES FOR STEALTHY ATTACKS

Summary from the TLDR InfoSec newsletter

A new botnet called KV-botnet is targeting firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR for covert data transfer by advanced persistent threat actors, including the China-linked threat actor Volt Typhoon. The botnet consists of two activity clusters, KY and JDY, which work together to access high-profile victims and establish covert infrastructure.