Will the Real Volt Typhoon Please Stand Up?

This report analyzes the JDY cluster of the KV Botnet—commonly attributed to the PRC-linked Volt Typhoon—using Censys scans and Lumen-published indicators to map control server infrastructure (IPs, ASNs, and a certificate SHA256) observed in 2023–2024. It documents hosting-provider migrations and new certificate variants following an FBI court-authorized disruption, lists current and historical C2 hosts, and flags an attribution uncertainty because the botnet proxy infrastructure shows lower operational tradecraft than Volt Typhoon’s targeted activity against organizations.