Volt Typhoon's Operational Framework Driving Strategic Access | Michael Horka

Michael Horka with Black Lotus Labs joins Lindsey O'Donnell-Welch with Decipher to talk about Silent Train, Volt Typhoon's operational framework that helps the group strategically avoid detection and attribution.
Timestamps0:00 – Intro: Michael Horka and Black Lotus Labs on Volt Typhoon0:55 – Michael's background: Black Lotus Labs and the FBI2:34 – Why the research matters: the attack methods, not just the victims3:26 – How the investigation began and the KV botnet takedown4:14 – Silent Train is an operational framework4:40 – One-time-use infrastructure: the means vs. strategic access5:28 – How the takedown pushed more use of Silent Train7:11 – How Silent Train works: the four-hop chain8:05 – Session lengths and the teardown of all evidence8:51 – Why there's nothing to detect outside working hours9:32 – Operational discipline: 27 device types, each with a fixed role11:33 – When the pattern became clear to the researchers12:30 – Why attackers go to such lengths to avoid detection13:23 – How hard is it to copy? Sticking to it is the hard part14:06 – Avoiding noise: no scanning, and device types other groups don't use15:26 – Victim notifications and the zero-day campaigns15:56 – Targeting control plane software17:13 – Highways, not houses: the victim sectors18:01 – Defender recommendations18:50 – Reduce internet exposure19:09 – Centralized logging and log retention20:22 – Protect your control plane tools21:29 – Final takeaways: targeting Hawaii, California and Texas23:18 – Wrap-up and thanks