Lumen's Michael Horka on China's 'Silent Train' Router Hacking

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends. We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now. TIMESTAMPS: 0:00 Intros 0:29 What is an ORB network? 2:34 Silent Train, an operational framework for Volt Typhoon 3:30 Why call it Silent Train? 4:12 Chains that exist for a few hours 6:47 The hijacked routers in the chain 8:16 Burning zero-days on a single hop 9:48 Attribution and the KV-botnet successor 11:02 Crown jewels and NetFlow visibility 14:53 Why network monitoring gets skipped 17:23 Victims in Hawaii, California and Texas 19:23 Four confirmed zero-days, all patched 20:47 Control plane software as the target 26:00 No-brainer defenses: logs and internet exposure 29:41 Threat hunting, agentic AI and where ORBs go next Links: Transcript Silent Train: Volt Typhoon's operational framework for zero-day exploitation Michael Horka | LinkedIn Michael Horka @ LABScon KV Botnet Investigation: How Compromised Routers Fueled Cyber Threats KV-botnet: Don't call it a comeback Lumen: Versa Director Zero-Day Exploitation Security Design Improvements for SOHO Device Manufacturers | CISA U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure Three Buddy Problem - YouTube