KV-Botnet (JDYFJ) Self-Signed TLS Certificate on SOHO Relay Nodes
Detects the presence of self-signed TLS certificates with the common name 'JDYFJ' in the certificate subject or issuer fields. This pattern has been associated with the KV-Botnet, which has been utilized by the Volt Typhoon threat actor to obfuscate command and control traffic through compromised SOHO routers.
Suricata
