CyberWire Daily
Botnet’s back, tell a friend. [Research Saturday]
Mar 8, 2025
Silas Cutler, Principal Security Researcher at Censys, dives into the enigmatic Volt Typhoon and its botnet, KV. He explains how the FBI's efforts disrupted infected systems without affecting the control infrastructure, suggesting a stealthy operator behind the scenes. Analysis reveals shifts in the botnet’s control servers in response to law enforcement. The conversation also tackles the challenges of attributing cyber threats, the strategic use of U.S. hosting for disguise, and the surprising links between patent databases and cybersecurity vulnerabilities.
22:47
Episode guests
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Volt Typhoon exhibits sophisticated operations by employing manual techniques and maintaining consistent SSL certificates for tracking, indicating strategic planning amid disruptions.
- The FBI's efforts against the KV Botnet highlight the challenges of targeting infrastructure, as Volt Typhoon's servers remain elusive and largely stable despite attempts to disrupt them.
Deep dives
Understanding Volt Typhoon's Operations
Volt Typhoon is identified as a threat actor operating primarily from China, employing unique tradecraft that differentiates it from other cybercriminals. This group often conducts operations manually, using available tools within targeted networks rather than relying on traditional malware. A key aspect of their operations can be seen in their first stage malware, which communicates through a consistent SSL certificate, allowing researchers to track their servers effectively. The unusual decision to maintain this certificate after a noted disruption by the FBI suggests a level of strategic planning or contractual constraints that may limit their operational changes.
Remember Everything You Learn from Podcasts
Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
