Exploited: The Cyber Truth

In this episode of “Exploited: The Cyber Truth,” host Paul Ducklin returns with Joe Saunders, CEO and Founder of RunSafe Security, to dissect the alarming Salt Typhoon campaign that infiltrated major telecommunications companies across the United States and beyond. This Chinese state-sponsored group has been quietly harvesting sensitive communications data for at least two years, including potentially accessing conversations of high-profile political figures.

Joe explains how Salt Typhoon represents China’s long-term strategic approach to cyber espionage—playing the long game with well-funded teams operating globally. The discussion explores how attackers exploited vulnerabilities in Cisco routers to create their own backdoor access, compromising hundreds of thousands of devices simultaneously.

In this episode:

• How Salt Typhoon cleverly subverted “lawful intercept” infrastructure designed for legitimate government surveillance, turning it against its creators
• Why fileless malware like the “Demodex” rootkit makes detection nearly impossible by operating only in memory
• The surprising connection between video game cheating software and nation-state hacking tools
• Why metadata collection is a powerful intelligence tool, revealing critical patterns even without accessing conversation content
• Practical approaches to defense-in-depth security and the importance of memory safety in preventing these sophisticated attacks
• The need for systematic approaches to security rather than just patching individual vulnerabilities after discovery

In the debut episode of “Exploited: The Cyber Truth,” host Paul Ducklin talks with Joseph M. Saunders, CEO and Founder of RunSafe Security, about the serious threat Volt Typhoon poses to critical infrastructure in the U.S. and beyond. What makes this Chinese state-sponsored group so dangerous, and how are they exploiting the software in devices that make our world run?

Joe breaks it all down, explaining the big-picture geopolitical motivations behind these attacks. You’ll also learn how attackers use memory-based vulnerabilities to quietly gain long-term access to critical systems without leaving obvious clues.

In this episode:

• How Volt Typhoon is targeting critical infrastructure in sectors like transportation, communications, and financial services to create potential footholds for future conflicts
• Why memory-based vulnerabilities are a major risk, enabling attacks that are hard to detect and trace
• Practical ways to secure systems—like rewriting code in memory-safe languages or using advanced memory protection techniques like load-time function randomization
• How Secure by Design and Secure by Demand initiatives can drive adoption of practices to improve cybersecurity in critical infrastructure