Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Volt Typhoon, a sophisticated China-linked APT group, exploited at least four zero-day vulnerabilities in critical systems while masking their activity through rapidly rotating relay chains of compromised home, IoT, and enterprise devices. The use of disposable infrastructure made attribution and detection extremely difficult, allowing persistent access to persist undetected. Zero-day exploitation combined with a covert relay network represents a dual failure: organizations had no patch available yet also lacked the network visibility needed to detect unusual lateral movement. This matters because critical infrastructure operators must assume that sophisticated adversaries will exploit unknown vulnerabilities, making detection and segmentation controls just as vital as patching.