Volt Typhoon rebuilds malware botnet following FBI disruption

Volt Typhoon, a Chinese state-sponsored APT, has begun rebuilding its KV‑Botnet by compromising outdated Cisco RV320/325 and Netgear ProSafe routers using MIPS-based malware and webshells; SecurityScorecard observed roughly 30% of internet-exposed RV320/325 devices compromised in 37 days, with the botnet employing a self-signed 'jdyfj' certificate, non-standard ports, and geographically chosen bridges to proxy and obfuscate traffic, showing active, persistent campaign activity following a January disruption.