KV

Internal ID: sh.kv

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying sh.kv. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

KV is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.lumen.com/kv-botnet-dont-call-it-a-comeback/

→https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/

→https://censys.com/will-the-real-volt-typhoon-please-stand-up/

→https://pylos.co/2025/07/23/will-the-real-salt-typhoon-please-stand-up/

→https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical

→https://www.securityweek.com/wp-content/uploads/2024/01/Volt-Typhoon.pdf

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

sh.kv

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KV