Michael Horka with Black Lotus Labs joins Lindsey O'Donnell-Welch with Decipher to talk about Silent Train, Volt Typhoon's operational framework that helps the group strategically avoid detection and attribution.
Timestamps0:00 [https://www.youtube.com/watch?v=-0eF1NIGoK4&pp=0gcJCWMAwfN6Pr3D] – Intro: Michael Horka and Black Lotus Labs on Volt Typhoon0:55 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=55s] – Michael's background: Black Lotus Labs and the FBI2:34 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=154s&pp=0gcJCWMAwfN6Pr3D] – Why the research matters: the attack methods, not just the victims3:26 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=206s] – How the investigation began and the KV botnet takedown4:14 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=254s] – Silent Train is an operational framework4:40 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=280s] – One-time-use infrastructure: the means vs. strategic access5:28 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=328s] – How the takedown pushed more use of Silent Train7:11 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=431s] – How Silent Train works: the four-hop chain8:05 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=485s] – Session lengths and the teardown of all evidence8:51 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=531s&pp=0gcJCWMAwfN6Pr3D] – Why there's nothing to detect outside working hours9:32 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=572s] – Operational discipline: 27 device types, each with a fixed role11:33 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=693s] – When the pattern became clear to the researchers12:30 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=750s] – Why attackers go to such lengths to avoid detection13:23 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=803s] – How hard is it to copy? Sticking to it is the hard part14:06 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=846s] – Avoiding noise: no scanning, and device types other groups don't use15:26 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=926s] – Victim notifications and the zero-day campaigns15:56 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=956s] – Targeting control plane software17:13 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1033s&pp=0gcJCWMAwfN6Pr3D] – Highways, not houses: the victim sectors18:01 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1081s] – Defender recommendations18:50 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1130s] – Reduce internet exposure19:09 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1149s] – Centralized logging and log retention20:22 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1222s] – Protect your control plane tools21:29 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1289s] – Final takeaways: targeting Hawaii, California and Texas23:18 [https://www.youtube.com/watch?v=-0eF1NIGoK4&t=1398s] – Wrap-up and thanks

Volt Typhoon's Operational Framework Driving Strategic Access | Michael Horka

It may be spooky season, but we start by discussinf the fact that the frightening prospect of mass PHP2Shell exploitation has not materialized. Some good news! Then we dig into the Silent Train operational infrastructure report that Black Lotus Labs released detailing Volt Typhoon's activities. Finally, we have some spooky-themed malware names for you!

Timestamps

0:00 [https://www.youtube.com/watch?v=REgsMU30l9w] Intro and Halloween small talk2:36 [https://www.youtube.com/watch?v=REgsMU30l9w&t=156s] Update on the PHP-to-shell vulnerabilities: almost no confirmed exploitation4:38 [https://www.youtube.com/watch?v=REgsMU30l9w&t=278s] Why the hype happened and how it compares to Log4Shell6:19 [https://www.youtube.com/watch?v=REgsMU30l9w&t=379s] Retracted exploitation claims and how defenders used the lead time8:14 [https://www.youtube.com/watch?v=REgsMU30l9w&t=494s] Why the exploits are hard to build (what Dennis heard from Caliph)10:01 [https://www.youtube.com/watch?v=REgsMU30l9w&t=601s] Hype vs. everyday weaknesses that businesses don't prioritize11:39 [https://www.youtube.com/watch?v=REgsMU30l9w&t=699s] "Black October," Matt Johansson and cybersecurity going mainstream16:34 [https://www.youtube.com/watch?v=REgsMU30l9w&t=994s] Cybersecurity Awareness Month and the MFA takeaway17:00 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1020s] Entry-level security jobs and advice for new grads20:02 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1202s] Volt Typhoon and the Silent Train report (Lumen's Black Lotus Labs)23:01 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1381s] The Littleton, MA utility intrusion24:01 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1441s] Volt Typhoon's targets and its use of SOHO routers and IoT devices26:10 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1570s] Operational discipline in how they rotate infrastructure28:26 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1706s&pp=0gcJCWMAwfN6Pr3D] Threat actor naming conventions29:46 [https://www.youtube.com/watch?v=REgsMU30l9w&t=1786s] Favorite spooky malware names: Ghost RAT, BlackCat, Spectre, Satan, GhostNet34:44 [https://www.youtube.com/watch?v=REgsMU30l9w&t=2084s] Halloween costumes and the Halloween nor'easter story36:45 [https://www.youtube.com/watch?v=REgsMU30l9w&t=2205s&pp=0gcJCWMAwfN6Pr3D] Outro


In Cybersecurity, Every Month is Black October

Tom Hegel of SentinelLabs joins Dennis Fisher for a deep discussion of the value of a broad background, not just in tech but in life, how threat intelligence teams function, and the wide range of effects AI is having on how defenders and attackers function.
Timestamps0:00 [https://www.youtube.com/watch?v=UGJX_JQry4U] – Welcome and intro with Tom Hegel0:40 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=40s] – LabsCon recap and the standout opening talk2:10 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=130s] – How Tom got into security: taking apart VCRs and repairing hardware3:35 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=215s] – Fake antivirus, forensics and the early days of the industry5:49 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=349s] – From MSSPs and SIEM vendors to Sentinel One7:02 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=422s] – 90s self-sufficiency culture and Pringles-can cantennas8:24 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=504s] – Hacking retro hardware with AI, and Doom on everything10:20 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=620s] – Why a broad foundation beats early specialization12:28 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=748s] – Threat intel: detection noise and writing for your audience15:17 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=917s&pp=0gcJCWMAwfN6Pr3D] – Diverse teams and global perspectives17:11 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1031s] – Echo chambers in the security community19:40 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1180s] – Underreported regions: Africa, Latin America and Chinese soft power22:09 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1329s] – Living with compromised devices and surveillance capitalism25:01 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1501s] – Post-compromise detection, and the PHP vulnerability hype28:22 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1702s] – N-days vs. zero days: what attackers actually use30:29 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1829s] – AI's early days and the long-term impact on software quality31:32 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=1892s&pp=0gcJCWMAwfN6Pr3D] – Slop software and the rise of risky DIY apps33:36 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2016s] – How threat actors use AI, from advanced groups to low-skill crime36:01 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2161s] – Parallels to the 90s "wild west" of hacking37:17 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2237s&pp=0gcJCWMAwfN6Pr3D] – Defenders are empowered by AI too38:00 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2280s] – Will people still understand how software works?39:20 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2360s] – Cognitive decline and using AI without losing skill40:39 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2439s] – AI-generated threat intel reports and accuracy43:22 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2602s] – Hype-chasing vendors and AI slop45:13 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2713s] – Trusting proven experts45:50 [https://www.youtube.com/watch?v=UGJX_JQry4U&t=2750s] – Small, trusted conferences and private signal groups

Threat Intel That Delivers | Tom Hegel

This week was a tale of two stories: the PHP2Shell vulnerabilities and the compromise of several certificates issued by CA eMudhra in India.
Timestamps00:00 [https://www.youtube.com/watch?v=SZVcFoxQqb0] — A wild week in security news02:50 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=170s] — PHP vulnerabilities and the disclosure drama08:07 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=487s&pp=0gcJCWMAwfN6Pr3D] — Why coordinating an embargo is so difficult10:02 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=602s] — Preparing for the PHP patches11:29 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=689s] — The PHP bugs make national headlines13:44 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=824s&pp=0gcJCWMAwfN6Pr3D] — Inside the researchers’ PHP vulnerability analysis15:56 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=956s] — Exploit risk, patching, and the long tail18:06 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=1086s] — Cloudflare’s mitigation and the response so far21:44 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=1304s] — Compromised certificate authority keys23:37 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=1417s] — Revoking certificates and restoring trust25:07 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=1507s] — The hidden infrastructure behind internet security28:11 [https://www.youtube.com/watch?v=SZVcFoxQqb0&t=1691s] — “We have a problem here” — shout-out to Wayne29:22 — What’s coming next

PHP2Shell and a Big CA Compromise

The newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are as serious as everyone feared, and Ben Harris of watchTowr joins Dennis Fisher to discuss their long-term impact.Timestamps00:00 - Introduction and why the PHP bugs are a big deal00:22 - The disclosure process starts to unravel01:04 - Why the two PHP vulnerabilities are so severe02:07 - Why the embargo mattered and why the leak was dangerous02:49 - PHP’s massive footprint across the internet04:08 - What mitigations can and cannot do05:35 - Comparing this to Log4Shell06:32 - Why sysadmins outside security are suddenly paying attention07:22 - Why old assumptions about disclosure may no longer hold08:48 - How LLMs accelerate reproduction from tiny clues09:13 - Why even partial screenshots and leaked video can be enough10:33 - A rough six to twelve months ahead for security teamsLinksPHP blog: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/Our story: https://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/

PHP2Shell Bugs and The Impact for Defenders | Ben Harris

Cybersecurity policy can stall when technical experts and lawmakers speak different languages. Beau Woods, CEO and founder of Stratigos Security [https://www.linkedin.com/in/beauwoods] joins Lindsey O’Donnell-Welch to explain how Hackers on the Hill brings cybersecurity researchers and policymakers together to build understanding and move ideas forward.



Timestamps

0:05 Introduction to Beau Woods

1:46 The Origins of Hackers on the Hill

5:48 Bridging Cybersecurity Research and Policy

9:43 Misconceptions in Cybersecurity Legislation

13:47 Growing Technical Literacy in Government

19:46 Applying Security Across Critical Sectors

25:47 Mock Hearings and Policy Conversations

28:36 Cyber Policy Shark Tank

31:58 AI, Cybersecurity, and Public Policy

36:57 Societal Goals Over Technology

37:33 Closing Thoughts

When Hackers Meet Policymakers | Beau Woods

This week, we're talking about hacked refrigerators, the FBI disrupting a North Korean laptop farm run by Famous Chollima, and a stealthy network of ads used to deliver mercenary spyware via a zero-click exploit.
imestamps0:00 [https://www.youtube.com/watch?v=-jtGD-1F9N8&pp=0gcJCWMAwfN6Pr3D] Intro & new video bumper2:00 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=120s] Hacked supermarket refrigerators3:39 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=219s] Default credentials and exposed controllers6:47 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=407s] Food losses, overheating, and real-world impact9:47 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=587s&pp=0gcJCWMAwfN6Pr3D] The risk of “smart” connected devices15:29 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=929s] Why security warnings don’t reach operators22:09 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=1329s] Spyware delivered through targeted ads27:17 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=1637s&pp=0gcJCWMAwfN6Pr3D] The scale of modern mercenary spyware33:10 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=1990s] North Korean fake IT-worker operations37:56 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=2276s] Inside the laptop-farm scheme42:57 [https://www.youtube.com/watch?v=-jtGD-1F9N8&t=2577s] What’s coming next on DecipherLinksCitizen Lab report: https://citizenlab.ca/research/how-di... [https://www.youtube.com/redirect?event=video_description&redir_token=QUZZTVljRWlScU9nUWI0V0RSWDJldjlDS2JoLXxBSTVJdTV2YU56cUxudWNRbFpTam9oNzJwTU5DLU9RdmdJNHRRQXBkWEpJVUl4RGlqb1Bud09jbHdhbkY1c3BJdG9UZ1hENmU3ZE9MWmhOekNWeFBWdUVFYV9UVl9ZaUVnN1FF&q=https%3A%2F%2Fcitizenlab.ca%2Fresearch%2Fhow-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware%2F&v=-jtGD-1F9N8]FBI advisory on Famous Chollima: https://www.justice.gov/opa/pr/justic... [https://www.youtube.com/redirect?event=video_description&redir_token=QUZZTVljRnB2RVl3R01BbXF1YmQybVNkU1hORnxBSTVJdTV2MnVaNmp2XzgtUE5ZdFdxaGpZSkFzQnBHUGRfbzUwSzRqdUVmZDczME8zQjRseVJpWVJCQXBWYVBXUTVNb3ZPcG56Zy1xOWdocjg1WDNlNjFWRngxZW9VUE9PN3h3&q=https%3A%2F%2Fwww.justice.gov%2Fopa%2Fpr%2Fjustice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker&v=-jtGD-1F9N8]

Hacked Fridges, North Korean Laptop Farms, and Mercenary Spyware

John Hammond of Huntress joins Dennis Fisher to dive into the ClickFix attack episdemic, how these attacks work, what the payloads are, and what individuals and organizations can do to protect themselves against them.


The ClickFix Epidemic and AI-Enabled Attacks | John Hammond

This week we talk about all the news from THREATCON1, including why the idea of just patching faster doesn't work, how analysts handle threat actor communications in ransomware incidents, and what the NSA thinks of AI threats.


Why Patching Faster Doesn't Work, Ransomware Negotiation War Stories, and the NSA View of AI Threats

Bestselling author, podcaster, and all around great guy Shea Serrano joins Dennis Fisher and Lindsey O’Donnell-Welch to explore why Catch Me If You Can is more than a con-artist story: it’s a hacker classic and master class in social engineering, confidence, and deception. We unpack Leonardo DiCaprio’s performance, Spielberg’s tension-building, and the film’s memorable cast and scenes. Along the way, the conversation connects the movie to hacker culture and cybersecurity, and asks why Frank Abagnale’s cons still fascinate us today.LinksSubscribe to Shea's Good Movie newsletter: https://substack.com/@sheaserrano

Catch Me If You Can with Shea Serrano!

Dennis (@dfisher) · Zencastr

Dennis (@dfisher)

The editors of Decipher talk with a rotating cast of security practitioners, researchers, and executives about a variety of topics in the security and privacy fields.

Decipher Security Podcast