Volt Typhoon's Operational Framework Driving Strategic Access | Michael Horka

Michael Horka with Black Lotus Labs joins Lindsey O'Donnell-Welch with Decipher to talk about Silent Train, Volt Typhoon's operational framework that helps the group strategically avoid detection and attribution.
Timestamps0:00 (youtube.com/watch?v=-0eF1NIGoK4&pp=0gcJCWM…) – Intro: Michael Horka and Black Lotus Labs on Volt Typhoon0:55 (youtube.com/watch?v=-0eF1NIGoK4&t=55s) – Michael's background: Black Lotus Labs and the FBI2:34 (youtube.com/watch?v=-0eF1NIGoK4&t=154s&…) – Why the research matters: the attack methods, not just the victims3:26 (youtube.com/watch?v=-0eF1NIGoK4&t=206s) – How the investigation began and the KV botnet takedown4:14 (youtube.com/watch?v=-0eF1NIGoK4&t=254s) – Silent Train is an operational framework4:40 (youtube.com/watch?v=-0eF1NIGoK4&t=280s) – One-time-use infrastructure: the means vs. strategic access5:28 (youtube.com/watch?v=-0eF1NIGoK4&t=328s) – How the takedown pushed more use of Silent Train7:11 (youtube.com/watch?v=-0eF1NIGoK4&t=431s) – How Silent Train works: the four-hop chain8:05 (youtube.com/watch?v=-0eF1NIGoK4&t=485s) – Session lengths and the teardown of all evidence8:51 (youtube.com/watch?v=-0eF1NIGoK4&t=531s&…) – Why there's nothing to detect outside working hours9:32 (youtube.com/watch?v=-0eF1NIGoK4&t=572s) – Operational discipline: 27 device types, each with a fixed role11:33 (youtube.com/watch?v=-0eF1NIGoK4&t=693s) – When the pattern became clear to the researchers12:30 (youtube.com/watch?v=-0eF1NIGoK4&t=750s) – Why attackers go to such lengths to avoid detection13:23 (youtube.com/watch?v=-0eF1NIGoK4&t=803s) – How hard is it to copy? Sticking to it is the hard part14:06 (youtube.com/watch?v=-0eF1NIGoK4&t=846s) – Avoiding noise: no scanning, and device types other groups don't use15:26 (youtube.com/watch?v=-0eF1NIGoK4&t=926s) – Victim notifications and the zero-day campaigns15:56 (youtube.com/watch?v=-0eF1NIGoK4&t=956s) – Targeting control plane software17:13 (youtube.com/watch?v=-0eF1NIGoK4&t=1033s&am…) – Highways, not houses: the victim sectors18:01 (youtube.com/watch?v=-0eF1NIGoK4&t=1081s) – Defender recommendations18:50 (youtube.com/watch?v=-0eF1NIGoK4&t=1130s) – Reduce internet exposure19:09 (youtube.com/watch?v=-0eF1NIGoK4&t=1149s) – Centralized logging and log retention20:22 (youtube.com/watch?v=-0eF1NIGoK4&t=1222s) – Protect your control plane tools21:29 (youtube.com/watch?v=-0eF1NIGoK4&t=1289s) – Final takeaways: targeting Hawaii, California and Texas23:18 (youtube.com/watch?v=-0eF1NIGoK4&t=1398s) – Wrap-up and thanks