[Back to KV Botnet disruption](https://takedownindex.org/takedowns/kv-botnet-disruption)

# Organizations and roles

December 2023, State sponsored
[KV Botnet disruption](https://takedownindex.org/takedowns/kv-botnet-disruption)

Last reviewed August 21, 2026

The public record puts 3 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), United States | Operational lead | Executed the court-authorized deletion of malware from compromised routers. |
| | [United States Attorney's Office for the Western District of Pennsylvania](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-western-district-of-pennsylvania), United States | Prosecuting | Obtained the Rule 41 warrants. |
| | [Cybersecurity and Infrastructure Security Agency](https://takedownindex.org/organizations/cybersecurity-and-infrastructure-security-agency), United States | Supporting | Issued related guidance on Volt Typhoon activity. |

## Accountability

### Legal authority

Rule 41 search and seizure warrants, Western District of Pennsylvania

### Oversight

The record assigns prosecuting or judicial roles to USAO-WDPA.

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026