Volt Typhoon used disposable relay chains to conceal exploits of at least four zero-days

Volt Typhoon exploited at least four zero-day vulnerabilities using Silent Train, a network of compromised devices that conceals attack origins, BleepingComputer reported, citing Black Lotus Labs. The researchers believe the framework was reserved for selected high-value targets. Operators chain SSH connections through hacked devices, then remove tools, keys and configuration files after sessions typically lasting under 8 hours. By early 2025, disposable relays operated alongside compromised enterprise systems retained for one to three months. Targets included telecommunications providers, government agencies and utilities. Compromised management platforms enable broad administrative control and access to downstream customers.