How China’s Volt Typhoon hacked a small-town utility
Summary
This episode investigates how the Chinese state-sponsored hacking group Volt Typhoon infiltrated the municipal utility in Littleton, Massachusetts, exposing vulnerabilities in small-town critical infrastructure. Host Zach Hirsch details the incident, the response from cybersecurity firm Dragos, and the strategic reasons adversaries target smaller utilities to test tools for larger attacks. The discussion highlights the growing threat of persistent cyber espionage and the urgent need for improved security awareness among local utility providers.
Topics discussed
Introduction: Foreign hackers target small US utilities
Host intro and transition to Littleton story
Sponsor: Serval IT automation
Sponsor: NordLayer browser security
Profile of Littleton, MA and its utility manager
The suspicious FBI call and Nick Lawler's skepticism
Verifying the threat and the arrival of federal agents
Revealing the threat: Volt Typhoon and the pamphlet
Dragos threat hunting and identifying the intrusion
How the hack happened: Third-party vendor vulnerability
IT vs OT separation and successful containment
Rebuilding security and CISA stress testing
Sponsor: Pioneers of AI podcast
Why Littleton was a priority: Volt Typhoon's strategy
Prepositioning for future conflict and past attacks
Small towns as testing grounds for larger attacks
The role of AI and federal government in cyber defense
The importance of sharing breach information publicly
Conclusion: Cyber warfare and awareness
Sponsor: Cyber Daily newsletter
Tech News: Nvidia acquires Hugging Face
Tech News: Axon redesigns license plate cameras
Tech News: NYC bans AI in elementary schools
Tech News: MapQuest refuses to rename Lake Ontario
Credits and production team
Sponsor: Odoo business software
Sponsor: Cyber Daily newsletter
Listen ad-free on Castria