The Botnet is Back: SSC STRIKE Team Uncovers a Renewed Cyber Threat

SecurityScorecard’s STRIKE Team details the resurgence of Volt Typhoon, a state-sponsored APT that compromises end-of-life Cisco RV320/325 and Netgear ProSafe routers to build a JDYFJ botnet using MIPS-based malware and webshells (e.g., fy.sh), routes traffic via C2 servers and a VPN pivot in New Caledonia, and targets energy and critical infrastructure with persistent, hard-to-detect operations.