Lumen’s Michael Horka on China’s ‘Silent Train’ Router Hacking

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day’s session ends.

We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI’s KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now.

TIMESTAMPS:
0:00 Intros
0:29 What is an ORB network?
2:34 Silent Train, an operational framework for Volt Typhoon
3:30 Why call it Silent Train?
4:12 Chains that exist for a few hours
6:47 The hijacked routers in the chain
8:16 Burning zero-days on a single hop
9:48 Attribution and the KV-botnet successor
11:02 Crown jewels and NetFlow visibility
14:53 Why network monitoring gets skipped
17:23 Victims in Hawaii, California and Texas
19:23 Four confirmed zero-days, all patched
20:47 Control plane software as the target
26:00 No-brainer defenses: logs and internet exposure
29:41 Threat hunting, agentic AI and where ORBs go next

Links:

• Transcript
  
• Silent Train: Volt Typhoon’s operational framework for zero-day exploitation
  
• Michael Horka | LinkedIn
  
• Michael Horka @ LABScon
  
• KV Botnet Investigation: How Compromised Routers Fueled Cyber Threats
  
• KV-botnet: Don’t call it a comeback
  
• Lumen: Versa Director Zero-Day Exploitation
  
• Security Design Improvements for SOHO Device Manufacturers | CISA
  
• U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure
  
• Three Buddy Problem – YouTube