Chinese botnet containing hundreds of end-of-life Cisco and Netgear routers disrupted by US government

The US government has successfully disrupted a botnet created by a Chinese hacking group known as Volt Typhoon. The botnet was responsible for cyber attacks on critical national infrastructure (CNI) organizations in the US and other countries.

According to a security alert from the US Office of Public Affairs, Volt Typhoon had hijacked hundreds of small-office/home office routers from Cisco and Netgear brands across America. These routers were infected with the KV Botnet malware, which allowed the hackers to disguise themselves as the source of subsequent attacks on CNI organizations in the US and overseas.

In May 2025, the UK National Cyber Security Centre (NCSC) and other international intelligence agencies issued guidance to CNI operators, urging them to take preventive measures against Volt Typhoon’s attempts to access and hide on their systems.

The botnet takedown was authorized by a US court in December 2023. It involved removing the malware from the affected routers and taking additional steps to block other devices from communicating with the botnet. FBI Director Christopher Wray stated that Volt Typhoon’s actions posed a threat to sectors such as communications, energy, transportation, and water, and emphasized the FBI’s commitment to combating such threats. Attorney General Merrick Garland also highlighted the Justice Department’s proactive approach to protecting the nation’s CNI.

Deputy Attorney General Lisa Monaco emphasized the Department of Justice’s use of various tools to disrupt national security threats in real-time. She also underscored the importance of partnership with the private sector, as victim reporting is crucial in fighting cyber crime.

Sandra Joyce, Vice-President of Intelligence at Mandiant, a cyber threat intelligence company owned by Google, explained that Volt Typhoon’s methods make it challenging to detect their activity. They use compromised systems to blend in with normal network activity and continuously change the source of their activity. Despite the difficulties, Joyce believes tracking and identifying their actions is not impossible.

Unlock your business potential with our expert guidance. Get in touch now!

tra_20241209-the-complete-2025-comptia-certification-training-super-bundle-by-idunova.jpg

Get Ready for 2025 with Our CompTIA Training Bundle for Just $50!

stateless-firewall-featured-image-12052024-min.png

5 Benefits of Implementing a Stateless Firewall (and 3 Important Limitations)

AdobeStock_315682413.jpg

Chief AI Officers: The Key Players in AI Success

AdobeStock_272603267.jpg

How Employee Data Access Habits Are Impacting Australian Employers Negatively

teamwork-collaboration-businesspeople-Friends-Stock-adobe.jpg

UK Medical Trial of Four-Day Work Week Shows Increased Staff Happiness and Productivity

tr_20241205-uk-cyber-risks-underestimated.jpg

UK Cyber Risks Are ‘Significantly Underestimated,’ Cautions Security Chief

Online-shopping-retail-adobe.jpg

Tech Strategy Uncovered: Insights from Dan Lake, Vice President at Notonthehighstreet.com