KV Botnet Activity
Campaign · ATTACK:enterprise:C0035
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0035",
"title": "KV Botnet Activity",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0035",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--0c259854-4044-4f6c-ac49-118d484b3e3b",
"external_id": "C0035",
"domain": "enterprise",
"created": "2024-06-10T18:57:09.920Z",
"modified": "2026-07-31T18:47:16.890Z",
"version": "1.0",
"aliases": [
"KV Botnet Activity"
],
"tactics": [
],
"source_references": [
{
"source_name": "Lumen KVBotnet 2023",
"url": "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"
},
{
"source_name": "DOJ KVBotnet 2024",
"url": "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2963d541-8e6b-4376-a165-876145293a7e
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--429bf982-fdf7-4404-9544-2cc7942b5939
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49333b91-3071-4d7b-8bbd-b32d2e80d05f
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1584.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5898ba12-3f7f-4891-96b5-a1d464487013
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e33c2e7-90b9-4d1e-9925-74d9cf2b4ef6
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d68b5ba-dc59-4004-9742-3fbb0b22440e
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1055.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85e909bd-e5c0-423d-b3cd-410dad3b8b91
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86576242-a9d1-4fd8-82a2-0e7d09d57513
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--883cf8ae-faba-4dfa-82b9-b9c09282b4e2
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d2d1a8e-7fa4-4726-aad2-7a21dfbe1c87
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9949853c-ab7e-43c8-bc77-8b9b6bddba50
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9af9cf1d-daf4-4b78-b569-fe33de5ea198
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a53827f4-1b98-422e-b6fd-0504c3f05a73
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a69c8555-cd70-40ca-a250-d6e9c57f9279
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1564.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6c8454f-57ab-45a6-9b69-1794b17a860f
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1546
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf492c3c-026c-45f3-bdc4-9ea200af2bb4
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d40daa58-ca17-400c-b488-4508775e55e7
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → attributed-to → ATTACK:enterprise:G1017
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddbd85c0-2b3a-4311-966b-abc2e658c340
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--deaf1941-b388-44e5-a8e9-09da85bf1067
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e38f9a94-155a-485c-bed6-c745b07a54d9
Lumen KVBotnet 2023ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb94932d-5286-42c4-817d-5d04f59763b2
Lumen KVBotnet 2023