Decipher Security Podcast · 2026-10-30 · 37 min
Key moments - from our scoring
Substance score
26 / 100
Five dimensions, 20 points each
The Decipher team examines why despite intense media attention and initial threat warnings, the two PHP RCE vulnerabilities discovered by Calif have resulted in almost no confirmed exploitation - primarily honeypot hits and failed proof-of-concept attempts rather than active threat campaigns. Dennis credits defender community mitigations (particularly Cloudflare and infrastructure providers) and notes that the exploit complexity, even for elite researchers, may have limited adoption by threat actors with easier alternative targets available. The conversation then pivots to the manufactured "Black October" narrative pushed by vendors and social media, which Dennis and Lindsay rightfully dismiss as hype cycling rather than a genuine shift in threat landscape. They contrast this with substantive reporting on Volt Typhoon's infrastructure, covered in new research from Black Lotus Labs and Talos, revealing how this China-aligned APT maintains persistent access through rapidly rotating compromised SoHo routers, IoT devices, and residential proxies rather than conventional enterprise exploits. The episode concludes with discussion of barriers facing junior cybersecurity talent seeking entry-level roles, despite industry-wide hiring needs - emphasizing the value of broad foundational experience in SOCs or network engineering roles over early specialization.
Hosted by Decipher. The show scores 43.5/100 on substance across its analysed episodes. See the full show profile.
The exploit complexity was extremely high - even the researchers who discovered it took considerable time to develop a working exploit that doesn't work universally against all vulnerable PHP endpoints. Additionally, platform providers like Cloudflare deployed mitigations quickly, and threat actors have many easier RCE alternatives available in other software.
It's a vendor-driven marketing term suggesting heightened threat activity in October, but it's not substantiated; cybersecurity incidents occur consistently across all months. The term gained traction partly because AI-related vulnerabilities became mainstream news stories, not because of actual shifts in threat volume.
According to Black Lotus Labs research, Volt Typhoon uses rapidly rotating compromised SoHo routers, IoT devices, and residential proxies rather than conventional enterprise exploits, allowing cost-effective long-term persistence in victim networks across telecom, utilities, and government sectors.
Many companies seek "unicorn" candidates with unrealistic experience requirements for junior roles, when they should instead invest in developing broad foundational skills through SOC analyst or network engineer positions that teach holistic security understanding.
Researchers identified that Volt Typhoon had been present in the Littleton electric light and water departments for approximately 10 months before detection.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode contains a handful of genuinely useful observations - PHP exploit difficulty, Cloudflare mitigations blunting mass exploitation, and Volt Typhoon's operational discipline with device roles - but well over half the runtime is Halloween banter, costume stories, Halloween costume contest tangents, and career anecdotes that deliver zero operational value to a B2B security practitioner.
he was like, listen, this took us a long time to develop a working exploit for this
they don't want their operations disrupted...that kind of operational, like, discipline is, it's, it's wild
The commentary is entirely reactive - summarising others' research (Black Lotus Labs, Talos, CISA KEV) and restating consensus takes like 'threat actors use whatever works' and 'every month is Black October.' The closest thing to a non-obvious point is that pre-disclosure hype may have helped defenders prepare, but even that is not developed into a real argument.
I think we need to give some credit, as we did last week, to the defender community, you know, the folks like Cloudflare and the other big infrastructure providers that put mitigations in place
they don't always rush to the newest thing
There are no guests whatsoever - just two co-hosts who are security journalists chatting informally. The episode references conversations with practitioners (Tom Hagel from Sentinel Labs, Ty Dong from Calif) but those voices are entirely absent from the transcript, making this purely journalist-to-journalist commentary rather than practitioner insight.
My name is Dennis Fisher, here as always with Lindsay o' Donnell Welch
I talked to Tom Hagel from Sentinel Labs this week on the podcast too
The episode does name specific research (Black Lotus Labs/Lumen Silent Train report, Talos Cisco framework blog), a specific victim (Littleton, MA utility, ~10 months of dwell time), and references CISA KEV additions - giving it more named specificity than average. However, most claims lack numbers, timelines, or verifiable data, and the PHP exploitation section relies on anecdote ('texts I've gotten from people I trust').
the clearest publicly identified intrusion...US Utility intrusion actually was right here in Massachusetts, um, in Littleton...they got into their electric light and water departments and had been there, you know, lurking in there for like 10 months
some device types were uh, they said, reserved for, you know, very specific roles and they never would like, you know, use them for anything else
This is a casual co-host chat with no interviewing dynamic at all. Both speakers consistently validate each other ('yeah, no, that's actually like...', 'yeah, I know, it is interesting'), there are zero probing follow-ups, no pushback on any claim, and the conversation drifts freely into non-security topics for extended stretches. There is warmth but no craft.
Yeah, I know, it is interesting
Yeah, no, I agree
Computed from the transcript - who did the talking, and the words that came up most.
It may be spooky season, but we start by discussinf the fact that the frightening prospect of mass PHP2Shell exploitation has not materialized. Some good news! Then we dig into the Silent Train operational infrastructure report that Black Lotus Labs released detailing Volt Typhoon's activities. Finally, we have some spooky-themed malware names for you! Timestamps 0:00 Intro and Halloween small talk 2:36 Update on the PHP-to-shell vulnerabilities: almost no confirmed exploitation 4:38 Why the hype happened and how it compares to Log4Shell 6:19 Retracted exploitation claims and how defenders used the lead time 8:14 Why the exploits are hard to build (what Dennis heard from Caliph) 10:01 Hype vs.
Transcribed and scored by The B2B Podcast Index.
Speaker A: Hello and welcome to the Decipher podcast. My name is Dennis Fisher, here as always with Lindsay o' Donnell Welch. And this is a podcast again about PHP to shell and silent trains and some spooky, scary malware. Because it's Halloween time, Lindsay.
Speaker B: Yes. Happy Halloween.
Speaker A: Yeah, Happy Halloween. I don't actually know this. Are you a Halloween person?
Speaker B: I am. I'm a big Halloween person. Not a lot of people know that about me, so
Speaker A: I would. I actually probably would have bet money that you were not a Halloween person because, like, you, you strike me as like a very practical, like, down to earth person that's not gonna like, put out a whole, like a giant inflatable Pumpkin or the 15 foot Home Depot, you know, skeleton in your yard. But you do live, like on the North Shore, like near Salem, so I could see it.
Speaker B: Yes, that's. I think that's part of it. And then I. I would also say, like, I'm not like a gory Halloween person. I'm more of like a family friendly Halloween person. But yeah, like, I love, like, Halloween movies and going to Home Depot, and I. I don't buy any of those, like, giant, you know, like 20 foot skeletons or anything, but, uh, I like to look at them. So,
Speaker A: yeah, yeah, I could see it. I was never like the biggest Halloween person, like, trick or treating. Sure, that was fun when you're a kid or whatever, but, like, I was. And I do like horror movies and Halloween movies and stuff like that. But at some point, especially like after your kids, your kids are younger, but, like, once your kids are kind of done with Halloween, like, it just becomes a little bit of a hassle where you're like, I got to get up and answer the damn door for these. Like, I don't really want to do that. I just want to watch football or something. You know, like, kids can get the hell out of here. You know,
Speaker B: you just become more curmudgeony. And,
Speaker A: uh. Are you one
Speaker B: of the people that turns your lights off at. No, no, no,
Speaker A: no, no.
Speaker B: We're.
Speaker A: Because I was like, when I was 13 or whatever, I would have been the kid that was like, oh, this house has their lights off. Guess what? Like, yeah, here comes. Uh-huh. Yeah. Yeah. I grew up in the 80s. It was a little different. We were just like free range kids out there, you know? You know, go out trick or treating for like seven hours and your parents are like, oh, you're back already. Okay.
Speaker B: I know I'm experiencing the millennial Halloween, which I think I've told you we do trunk or treats and
Speaker A: like
Speaker B: all these like very like millen y' all things so very different now.
Speaker A: You guys are a little safer than we were. Yeah,
Speaker B: we're very safe. Yeah.
Speaker A: Yeah. Well that's good. That's good. All right, so let's, I guess we should probably start with like kind of an update on the PHP to shell thing that we talked about a few times last week actually on the podcast. Uh, pleased to report nothing has really happened. Like there's been almost no confirmed exploitation in the week since our last podcast. Anecdotally, like all I've seen from people that I trust is honeypot, uh, successful honeypot exploitation. I think gray noises confirmed that. A couple of other, uh, texts I've gotten from people like, hey, we, we saw a real successful exploit hit one of our honey pots. Most of what I've seen or heard has been mass scanning a lot of failed crappy exploitation attempts from, you know, I'm going to guess Vicod, uh, POCs. Um, but nothing in the way of what we thought might come, you know, especially because some of the details leaked out before the public disclosure. Uh, the CBEs were out there, there was a lot of noise about it. So I think, you know, we all assume that the threat actor community would sit up and pay attention to this and not much has happened, which is great. You love to see it. Um, I think we need to give some credit, as we did last week, to the defender community, you know, the folks like Cloudflare and the other big infrastructure providers that put mitigations in place that stopped a lot of what probably would have been mass exploitation attempts at least. Um, but no real stuff. I mean, I'm sure we'll see stuff down the line, uh, you know, for like somebody forgot that they have, you know, a PHP based tool that's exposed the Internet like four months from now or something like that, but it really hasn't materialized into much, which is great.
Speaker B: Yeah, I know, it is interesting. So I think you pointed to this, but the whole, the fact that some of those details came out before that coordinated response and disclosure process had officially been lifted, I think that might have played a bit of a big factor in why this was so hyped up like this. Because a lot of people saw two bugs in php, which PHP is a massive potential attack surface and always super lucrative for threat actors. And then also they saw two RCE blogs. So it's just like, of course people are going to want to jump on this and without the full details and knowing exactly what would need to go into that. I think there was a lot of that hype and almost like hysteria, which I don't think was a bad thing, um, because we didn't know at the time how bad it could have been. But now we're seeing the real world impact, which seems to be very limited. So I think that it's, it's good that we're now kind of, you know, keeping tabs on this. And researchers seem to be pretty practical. A lot of the researchers that I've seen where they're saying, hey, we're seeing attempts, we're not seeing actual exploitation, um, and we're seeing, you know, seeing this in honeypot environments. We're not seeing this across our actual partner or customer base. So I think, you know, it is, it is interesting to see and to compare those to like log for shell way back when where, you know, exploitation started pretty much right away.
Speaker A: I
Speaker B: think it's, it's been a very interesting kind of saga to see play out.
Speaker A: Yeah, and there were, there's, there were a couple of, early on, I guess probably over last weekend, a couple vendors or threat intel teams that came out and said, hey, we've seen successful exploitation. Uh, both of those were retracted, at least the two that I'm thinking of. There were probably others that, that happened to too that just like, weren't as noisy. But you know, that I think one of those turned out to be just like a failed poc and another one was just like not the same vulnerabilities at all. Which, you know, that's fine. Um, but it's interesting to me that I do think in this case, as you said, Linds, like the hype actually sort of helped I think because defenders did have a little bit of time to prepare, you know, not just the platform providers, but security teams. They could, you know, if they didn't know already, they could go and sort of figure out where they had php, what the upgrade path looked like, what they needed to do for, you know, maintenance, Windows taking things offline. You know, we saw a bunch of like US and foreign government agencies just take their sites offline because they were, you know, preparing, uh, to upgrade them. And I think we're also being, you know, not overly cautious, but correctly cautious about potential attacks. Um, and so it's, you know, I'm not sad to not see a bunch of mass exploitation in this. And also I think the other factor, the two other factors, one is there's a bunch of other vulnerabilities out there that attackers can use anytime they want. They don't always rush to the newest thing. Uh, you know, they have plenty of other things they can crack open Syskev and just like close their eyes and point to something and be like, hey, let's try this today. You know, there's lots of edge security devices out there that have plenty of RCE bugs in them that are probably easier to reach and easier to exploit than the PHP bugs, honestly. Um, and that's the other part of it. I talked to the guys at Calif this week who they discovered these two vulnerabilities and I talked to their CEO Ty, who I've known for a very long time and he said he's go look up what Ty Dong has done. But he's. And they have, their research team is ridiculous. They have some of the smartest M people on earth on this team. He was like, listen, this took us a long time to develop a working exploit for this. And he didn't say this but like, my subtext to that is like, we're the smartest people on earth and it took us a long time to do this and we were doing it without any real time pressures or anything. Like, you know, nobody knew we were doing this, so we weren't. There wasn't a race. But it took them quite a long time to figure out a working, uh, exploit. And it's not universal. It doesn't work against like every single potentially vulnerable PHP endpoint or anything like that. So it's not going to be real easy for a bunch of cyber criminals or even APT groups, honestly to just churn out a uh, working exploit for these.
Speaker B: Yeah, I think you make a good point. And, and by the way, I'm never pro hype. Even though, like, I want to clarify that
Speaker A: we are not pro
Speaker B: hype or hysteria or hype. But
Speaker A: no,
Speaker B: you make a good point that these bugs were all over the news as we talked about last week. They were on general news like Normie news, as we call it, and
Speaker A: civilian news.
Speaker B: Yes, regular people were hearing about this and threat actors are still out there, you know, targeting just the easy ways to get in. And I guess that is, that's an important thing to take into consideration is like all of this focus on two bugs where the exploitation is so difficult that even CISA says, you know, their, their attempts, you know, in their, when they added them to their Kev catalog. Like I have a concern that people are, when these types of things emerge, that we lose sight of the things that are those everyday run of
Speaker A: the
Speaker B: mill like weaknesses that businesses don't prioritize because they see a lot of the hype around, you know, these types of things that make the news.
Speaker A: Yeah, these are the things that security operators, uh, get texts about, you know, when they're trying to eat dinner from their CIO or somebody that's like, hey, what are we doing about these two bugs that are coming out tomorrow? Or came out this morning? And, you know, they're just like, uh, yeah, I know about this. But we also have, like, our identity infrastructure needs to be upgraded, and we have this problem. And, you know, our edge security devices have, like, nine RCEs in them that were reported six months ago that we can't take offline to upgrade because you won't let me. And, you know, those sorts of things. Yeah, all these practical considerations that just don't allow everybody to run to the console and hit the red button and, you know, take things offline and upgrade. It's. That's not really how the world works. Um, but, yeah, it is. I just saw this the other day. I was unaware that I don't know who this is. I don't really want to know. But there was somehow the phrase Black October has been going around for cybersecurity. We're at the end of October here. I don't know where the hell that came from. It's dumb as hell to me. I don't know. Is this a vendor thing or was this just some Twitter nonsense? But our friend Matt J. Matt Johansen did, like, a video about this. He's like, what the hell are you people even talking about? Like, every month is black. Like, just like, is this your first day on Earth? Like, this is what happens. Like, this is what we do here. Um, and I think he was making fun of. There was some video, I guess, with, like, Joseph Gordon Levitt was talking about how agentic AI attacks are hitting. Are getting into your bank account. And he was like, so actors are now our. Our sources of cybersecurity. What are we doing? I don't know. This is, like. Things have gotten so weird. It's just, like, spooky season for everything.
Speaker B: Yeah, I know. The. I was. I was also very confused by Black October. Like, end of last week, I was like, you know what? That. I've had a couple of weeks like that, you know, in my. In my tenure. Yeah, cybersecurity. Yeah. Um, it wasn't, you know, unfortunately, the, uh, Brotli vulnerabilities got a little lost in the, um. You know, the Emudra thing that we also covered last week. But it was just one of those weeks where there was a lot of news and it all hit at the same time. It's not because of some huge shift in AI in the vulnpocalypse. Like, this is just what we have dealt with in the past. Long before AI was a thing.
Speaker A: Yes. And it just wasn't. I think a lot of it has to do with, like, the outside world wasn't really paying as much attention to what all of us nerds were doing. But now with. I think AI is a big part of it. Just everybody, uh. All you have to do is attach the phrase AI to something and it becomes, like, a mainstream story. You know, you see it on the Today show or, like, extra or something, and you're just like, oh, my God, what. What has happened? Like, that's. None of this is even. Right. You guys just sort of, uh, like, took this and ran with it. But, I mean, that's just. That's just life on the Internet these days, I guess.
Speaker B: Yeah, no, that's actually like. It also had me thinking, is this how we want the world to learn about cybersecurity? And, I mean, you know what? Whatever it takes. But speaking of Matt, uh, Johansen, like, he. He had, um, another video about this that I also listened to. It was his podcast, and they were. They were basically like, is cybersecurity mainstream now? Which I was like, kind of is, because AI. Because of AI. Uh, but it's a really interesting discussion when you're looking at how cybersecurity is looked at by the world right now.
Speaker A: Yes. Just
Speaker B: because of that AI subplot, I guess, that's happening here.
Speaker A: It's a weird, weird thing. And this is. We've talked about this a little bit over the years on the podcast, but, like, early on in my career, first, uh, of all, it wasn't called cybersecurity, but nobody was paying any attention to security at all. Like, it just. Nobody gave a shit. Even in the tech world, people were like, oh, that's cute. Whatever you guys are doing over there with those passwords and firewalls, good for you. Like, you know, we're building giant routers and things. Okay. Um, but there's been a few, like, those inflection points over the years where our world, you know, seeps, you know, crawls under the tent and gets outside into the real world, and people are like, oh, wait, you're the person that knows about this, right? Like, this is what you do. Let me ask you this question. And you're just like, oh, My God, how did you hear about that thing? Or, uh, what, you know, why are you asking me about, like, agentic AI botnets or whatever?
Speaker B: Yeah,
Speaker A: I could do without that. But, you know, I think, you know, Matt's right about that. I do think it's become mainstream. It's like when your favorite band becomes a big thing and you're like, no, that's like my thing. I don't, I don't want you guys to know about that.
Speaker B: Yeah, as long as, like, people know, have good takeaways from it. Like, as
Speaker A: long
Speaker B: as people are like, okay, there is a vulnerability and I need to go patch all my shit, like, that's fine. But I don't know if that was like, necessarily the takeaway from the PHP thing. I'm very.
Speaker A: I don't think so.
Speaker B: If something about MFA went viral, then I would be all for that. Because that's something where the everyday person can take, Take it away, you know, have a practical takeaway that would actively make their cybersecurity life better.
Speaker A: Yes. Yeah, no, you're right. The PHP is not going to. But I guess everybody is aware given that this is Cybersecurity Awareness Month. Like, everyone's aware now. It's here we are.
Speaker B: We did it. Yes.
Speaker A: We can stop on Sunday on November 1st and just be unaware again. Um, yeah, we did it, everybody. It's funny that, um, I was having a conversation with a kid, ah. Who's like a junior in college around my kid's age, who's studying cybersecurity earlier this week and he was talking about how difficult it is to find internships or jobs and stuff. And I've heard this anecdotally from other people, like new graduates or things like that. And you know, it's so weird because it doesn't really line up with our experience of like, everybody we know is looking for help. You know, every large organization is looking for more security talent and things like that. I guess maybe not the entry level junior people, but those people have to come from somewhere, you know, uh, like my generation and your generation are not going to be here forever. We need new people to come in and help at some point.
Speaker B: Yeah, no, I agree. I think it's hard because a lot of companies are looking for like, almost like unicorn type of person. Um, 20
Speaker A: years of AI experience plus, you know, like 50 certifications and they want to pay you like 125k.
Speaker B: Yeah, exactly.
Speaker A: In Silicon Valley. Yeah, sure,
Speaker B: I know
Speaker A: you can get one of those things, but you can't get. Yeah,
Speaker B: there's something to be said about investing early in talent and, you know, helping them build up those skills and be able to get to that level. And um, you know, I think there is like, for a lot of people a bit of a course like, you know, going through the SoC or something is really helpful to better understand actually how those types of investigations play out and things like that. But um, I don't know. A lot of people I've talked to though, like, it's a lot of just like self teaching. I feel like that's
Speaker A: 100% it. Yes, Lindsay, that's exactly right. That's what I was telling this kid. Like he had gotten interested in this in high school, I think, and just saw it as like a good career path. And he's like, you know, I'd be happy to do anything in security. I'm not like, I don't only want to do this thing or this thing or this thing. He's like, I want to kind of learn all of it. I was like, that's a, you know, that's a great attitude. Because if you get, you know, a junior soc analyst role or security analyst role or uh, even network engineer role, that's what you're going to do. You're going to get to learn everything and you'll have like a broad foundation that'll serve you well later in your career, you know. And that's actually one of the things I talked about with Tom Hagel from Sentinel Labs this week on the podcast too, is like not just specializing super early and figuring out, you know, getting some base level of understanding of how everything kind of works so that you can apply that to other problems later on.
Speaker B: Mhm. Yeah, it's such a good point. I think, um, it's, it is interesting to see, you know, how things shift too just with,
Speaker A: yeah,
Speaker B: everything, you know, all the changes that have happened in the past few years. So.
Speaker A: Yeah. All right, so then the other story that I thought was kind of interesting and um, you know, we haven't heard much from the Volt Typhoon folks in a little bit. So they decided to stick their heads up or I guess more accurately, researchers decided to pull their heads above ground.
Speaker B: Yeah, I don't think we're going to see Volt Typhoon stick their heads
Speaker A: at
Speaker B: any time soon.
Speaker A: You're right. Uh, who
Speaker B: knows?
Speaker A: But they had, there was a new report from the Black Lotus Labs folks at Lumen, um, kind of exposing the silent train operational infrastructure that is, has been used by Volt Typhoon, I think they said over the last 3ish years that at least they've been tracking it. And it's kind of this interesting like very quickly rotating and um, morphing operational infrastructure that this group is using. This is a China aligned threat, uh, actor that people have been tracking closely for quite a long time. They're, you know, they're quite famous. They're, you may have heard of them. Um, Kim Zetter, one of our, you know, fellow journalists, wrote a, wrote a good piece on her, uh, her site about this stuff too. The Talos folks have a, I guess, um, parallel blog post about some uh, framework that was specifically targeting some Cisco products that Voltage Foon was using too. Um, but it's one of those reports where you look at it and you're like, man, all this stuff is still going on. Like everybody's running around worrying about like agentic AI security and you know, what this model is doing and do we have the right guardrails and all that kind of shit. And then you're like, oh, China's like varsity threat actors are just out here doing whatever the hell they want all the time still.
Speaker B: Yeah, and I know you've said on the podcast a lot that you know, China's just like in our networks just sitting there and this is the perfect representation of that. Um, I mean it is interesting. Like when you think of cyber attacks, you, you know, a lot of people might think of like more of the noisy threat actors, like ransomware, even like Iran I feel like, likes to you know, make their stamp with their cyber Avengers or whatever. But um, like I feel like Volt Typhoon, this, this blog post or this research was real. A really, really good um, description of, of how they operate and just how stealthy they are. And there's something where they're a group where like over the past few years we've heard about them time and again. And the researchers actually made a really good point which is that all the public reporting that we've heard of so far has been focused mainly on their victims and then their objectives. But like we didn't. Like there's not a ton about actually like how, how they've worked and kind of those access methods and all the activities. But you know, it's, it is true, we haven't heard much. Um, the clearest publicly identified intrusion, utility, um, US Utility intrusion actually was right here in Massachusetts, um, in Littleton. I don't know if you remember that a couple of years back. But
Speaker A: yeah,
Speaker B: like this small, little random town in Massachusetts, Littleton, uh, which is
Speaker A: literally little town,
Speaker B: uh, I guess they got into their electric light and water departments and had been there, you know, lurking in there for like 10 months. That's just wild to hear about. But anyways, that was kind of like one example of where you might have seen them lurking in kind of their networks. But they've been, they've
Speaker A: been all over the place.
Speaker B: Yeah.
Speaker A: And it's, it's interesting to me, like the victimology is exactly what, what you would think it is. It's telecom providers, you know, government agencies, defense, industrial based companies, satellite communications, you know, colleges, universities, tech companies, that kind of stuff. But most of the time this level of threat actor that's going after those targets is going after things like, you know, edge security devices, which we talk about all the time, SD WAN orchestrators, all these big enterprise grade products that they probably have exploits for sitting in their toolkits. Right. But in this case they were also going after like SoHo, SoHo routers, IoT devices, um, residential proxies, that kind of stuff. And that's the stuff that they were churning through, turning over and over really quickly, um, as part of their operational infrastructure. Which makes sense because those things are a dime a dozen. You can literally just buy large chunks of them that are already compromised, um, from initial access brokers or things like that. So they were kind of using the whole like, you know, Cheesecake Factory menu of stuff to, to get at you. Which you know, again, sort of underscores the point of like threat actors will use whatever they can. They don't, they're not, you know, they're not partisan to one thing or another. They don't have to have zero days, they don't have to have PHP to shell. They've got 2000 compromised SoHo routers that they can just use as jump boxes to get to whatever network they want.
Speaker B: Yeah. And I think that deep dive into kind of how they really quickly rotated those different chains of compromised devices gave some really good insight into how exactly threat actors or uh, you know, these specific threat actors are fine tuning kind of those methods to decrease that risk of detection and even attribution and disruption too. So, and it was, it was really cool reading the research because there was a ton, it got really down into the weeds of what, what they were doing, all the way down to the fact that some device types were uh, they said, reserved for, you know, very specific roles and they never would like, you know, use them for anything else. So that was really, it's
Speaker A: not
Speaker B: like they were just like, you know, chaining these together willy nilly like that was Fascinating to me.
Speaker A: That's like the kind of operational discipline that you see in, you know, military units, to be frank, or, you know, this is a Chinese, uh, you know, aligned threat actor. Those groups, whether they're military or not, have discipline. You know, that's just sort of the culture. So. Yeah, that, that kind of, that stuff is always. I love reading that stuff, as weird as that sounds. You're just like, oh, man, damn, they're really on it. Like, they're not just, you know, they're, they're not making these kind of mistakes, you know, that might, that might disrupt their infrastructure. They don't really care about being noticed. Like, they, you know, U.S. government agencies know that China is doing this stuff. That's not any big revelation. But they don't want their operations disrupted. Right. So they want to. That. Yeah, that kind of operational, like, discipline is, it's, it's wild.
Speaker B: Yeah. And even just the fact that they would reserve this Silent Train framework for the, for very, very specific, uh, parts of their attack too.
Speaker A: So
Speaker B: they weren't just pulling this out, like, for any random thing. Like I think they said it was for different. Even within attacks, like phases of the attack, like that, you know, credential access phase or the data data exfiltration phase or things like that. Um, and I think it really just shows the strategizing that would go behind these, these different types of attacks.
Speaker A: Yeah, it's the good silverware in China that you bring out for Thanksgiving or whatever when your in laws come.
Speaker B: Exactly. Yeah.
Speaker A: It's not the random everyday crap that we use.
Speaker B: Yeah,
Speaker A: um, yeah, it was. I always wondered, like, when, um, when these reports come out and they have a cool name like Silent Train or something like that. Uh, I always wonder, you know, that the threat actors read this kind of stuff. Like, they're very aware of the reporting that goes on against them. I wonder what they think of these names. If they're like, yeah, Silent Train. What do you guys think? Like, that's good, right? Like, it's kind of cool. Like, some of them are, you know, some of the threat actor names, like, especially some of the, the Microsoft ones, you're just kind of like, I don't know, man, like, you know, like purple broccoli or whatever. I forget what Microsoft conventions are. Some of them are good, some of them aren't. But Silent Train's not bad if you're going to be. Yeah,
Speaker B: Uh, I kind of get the, like, the other thing is, I kind of get the intent behind it. Whereas some of those ones where you're just like. I don't know,
Speaker A: it's just like a random list of adjectives and nouns, and there's like, boom, you get this, you know,
Speaker B: compound word.
Speaker A: Yeah, that's it. It's Mad Libs. You're like, ah. Ah, God. Guys, come on. Just hire an English major to help you out here.
Speaker B: Yeah,
Speaker A: we need jobs, too. Um, all right, so I sent you a text this morning, and I said, hey, let's try and, uh, come up with our favorite Halloween or spooky themed malware or attack or vulnerability names. And then I forgot to go and, like, come up with my list, but I'm gonna come up with a few off the top of my head. Um, were there any that, like, jumped right to mind when you. When I. When I texted you that
Speaker B: the first one that came to mind was Ghost Rat? That's pretty obvious. And then after some thinking, I also remembered. Do you remember Black Cat ransomware? I know it
Speaker A: was
Speaker B: only from a few years ago, but I feel like we've had so many ransomware groups like.
Speaker A: Yes,
Speaker B: and this is the same, by the way. I wrote this week about, um, some Ukrainian guy affiliate who was behind the hive and, uh, Nephilim ransomware. Uh, groups like. Yeah, I don't. I'm sure I butchered that name, but he got, uh, sentenced to five years in jail. But I. When I was writing about those two ransomware groups, I was like, oh, my gosh, those must have been, like, from, you know, 2010 or something back. And I was like, 2020 and 2021 was.
Speaker A: It hurts. I know
Speaker B: so many ransomware names, but Black Cat, anyways, was the other one I thought of.
Speaker A: Black Cat is. Is that one of the ones that more like disbanded and morphed into some other rebranded and something like that.
Speaker B: Yeah, I, uh,
Speaker A: feel like it was.
Speaker B: I think they, like, came together from Dark side and Black Matter and, like, uh, that fin7. Like. Yeah, if you remember that too. And.
Speaker A: Yes.
Speaker B: Yeah. And then they did. Did they do the Colonial Pipeline attack or they, like, launched the Colonial Pipeline attack, and then they kind of, like, went away or something after that?
Speaker A: I think that was the end for them, if I remember right. Yes. That very quickly,
Speaker B: you knock on that door,
Speaker A: you.
Speaker B: You kind
Speaker A: of go
Speaker B: away.
Speaker A: Yeah. It's like hacking the FBI's personnel records. Like, things just. Yeah, the curtain's coming down. Yeah. Um, those are good ones. The one that immediately came to mind for me was Specter, which is just. It's one of those side channel attacks that, like, we always talk about, like, we don't. It's literally just black magic. I don't understand how that shit works at all. But the Spectre logo is just so great because it's a little, you know, like clip art ghost. Like a Pac man ghost almost that just has a stick and it's like. That's just it. Like it's not fancy, you know, Um, I love it so much because it's just so low fi and so goofy. Is just like, hi, I have a stick. Okay.
Speaker B: That's why. You know what? That's what was missing for PHP to shell.
Speaker A: Yep.
Speaker B: We needed some sort of cute little logo.
Speaker A: I mean, Calif. Put out that blog post that was like a literal graphic novel
Speaker B: that
Speaker A: was really
Speaker B: cool.
Speaker A: Way cooler than a logo. They. I talked to Ty about like how that came to. Came about. It's very cool. Um, I'll tell some of that story later. But um, yeah, Spectre was one that jumped to mind for me. And also like the original. I don't know about original, but back in the 90s, IBM released this like password tool called Satan, which like is an actual acronym. It stands for something. I forget what it is. It's like, I don't know, security auditing tool. I don't know, something like that. Um, very famous. A lot of like old people like me know about it. But yeah, Spectre and Satan, two good ones. There was a few botnets that had like, weird. There was the Storm Botnet that had some kind of spooky connotation, I can't remember. Um, Ghostnet, which is that cyber espionage operation, that citizen lab, uh, exposed like 15 or 16 years ago. One of the first like big. I think it was China. Um, one of the first big cyber espionage operations ever sort of uncovered. Um, that's kind of, uh, it. I know there's a lot more. There's a bunch of old Ms. DOs and VBS type viruses and kind of prank wear stuff that would like pop up Jack O Lanterns or you know, Draculas or something on your screen if you open an attachment. But yeah,
Speaker B: yeah, I feel like I'm blanking but like one of the malware loaders had something, some sort of Halloween. I'm blinking on which one it was. It was one of those ones where
Speaker A: like imhot or something like that that just like dropped some
Speaker B: like. Yeah, like Bumblebee or. I don't know, maybe I'm just thinking of the silly names but, uh,
Speaker A: somebody will point it out. Yeah. If you have, if you can remember what that is or if you have any other Favorite spooky Halloween malware things. Let us know. Um, yeah, what are the. Do you, you're not dressing up for Halloween, right? Like you don't.
Speaker B: Yeah, I don't, I don't dress up. I did buy a witch's hat, so I might wear that while I trick or treat with my kids. But I don't
Speaker A: go
Speaker B: out. Yeah,
Speaker A: it's. I'm always a little like, I know there's. For whatever reason, like there's a big sort of Halloween thing in the security. Like lots of security people are Halloween people. It's just. I don't know, I don't know what the crossover is but um, adult, like I'm not like an adult dress up type person. I think we went to a, like a costume party. This is like literally like probably 15 years ago was the last time we did any sort of uh, thing like that.
Speaker B: Mhm.
Speaker A: I dressed up as Mr. Clean.
Speaker B: Great.
Speaker A: Yeah, just like literally a white T shirt, shaved head, white pants.
Speaker B: You already had the fit done.
Speaker A: Yep, that was it. It was great. I loved it so much. And the, the best part about that. Or not best part, but like, you know, this time of year there was a huge nor'. Easter. Knocked out the power in Plymouth, like in our town. I
Speaker B: know that exact year. Yeah,
Speaker A: yeah. And we ended up like we were supposed to be at one one of our friends houses for this but their power was out so we had to go to somebody else's house like four blocks over and we all just like literally walked like through the woods and shit. And by the time we got to this other house, my like white thing was just like covered in mud and like had leaves stuck to me. I looked like an absolute maniac. Yeah, it was fun.
Speaker B: I remember that. Then uh, it was like the Halloween nor' Easter of like, uh, I forget year that was. But yeah,
Speaker A: it was a long time ago. Yeah,
Speaker B: people were not afraid of it though. They, they went out in their classrooms and. Yeah,
Speaker A: people were. Yeah, that was one of those nights where you're just like, seems like all bets are off. Like you could kind of do whatever you want. We just, you know, saw people walking down the street with beers and like doing whatever and you're just like, yeah, it's kind of making a blizzard or whatever. Like no, people are just going to leave you alone.
Speaker B: Yeah, no one's going to get in trouble for doing that. Everyone's just trying to, you know, everyone's just
Speaker A: trying
Speaker B: to enjoy Halloween on a nor'. Easter.
Speaker A: That's it. Yeah. All right, well, I hope you enjoy Halloween and Trunk or Treat and all that kind of stuff. And, uh, everybody be safe out there. And, um. Yeah. Have a great weekend.
Speaker B: Talk
Speaker A: to you soon. See ya.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
Bilt's Director of Identity, Ryan: Fraud is a Tax on EveryoneRisk and Reason · on Residential proxies88 / 100
The Hidden Risk of Your InfrastructureThreat Talks · on Volt Typhoon81 / 100
Encore: 39 Seconds to BreachThreat Vector by Palo Alto Networks · on Volt Typhoon80 / 100
TWiET 573: DNS Deep Dive Part 3: Exploring Internal DNS and AD - KV-Botnet, Internal DNS Security, and Farewell EpisodeThis Week in Enterprise Tech · on Volt Typhoon75 / 100
210: The One About the Future of Cyber WarfareThe Government Huddle with Brian Chidester · on Volt Typhoon63 / 100
Digging into regulatory compliance issues. Control Loop: The OT Cybersecurity Podcast · on Volt Typhoon56 / 100