KV

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: sh.kv

Threat Analysis

KV is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning KV

Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT

The Hacker News· Jun 3, 2026

TP-Link, Canva, HikVision vulnerabilities

Cisco Talos Blog· Mar 26, 2026

Detecting IP KVMs, (Tue, Mar 24th)

SANS ISC· Mar 24, 2026

In Other News: New Android Safeguards, Operation Alice, UK Toughens Cyber Reporting

SecurityWeek· Mar 20, 2026

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

The Hacker News· Mar 18, 2026

Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog

The Hacker News· Mar 6, 2026

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA Alerts· Mar 5, 2026

External References

→https://blog.lumen.com/kv-botnet-dont-call-it-a-comeback/

→https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/

→https://censys.com/will-the-real-volt-typhoon-please-stand-up/

→https://pylos.co/2025/07/23/will-the-real-salt-typhoon-please-stand-up/

→https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

KVsh.kv

External Intelligence

Malpedia: sh.kv

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KV