# Volt Typhoon used disposable relay chains to conceal exploits of at least four zero-days

_Published Wednesday, October 28, 2026 at 2:01 PM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![Volt Typhoon used disposable relay chains to conceal exploits of at least four zero-days — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/28/silenttrain.jpg)

Volt Typhoon exploited at least four zero-day vulnerabilities using Silent Train, a network of compromised devices that conceals attack origins, BleepingComputer reported, citing Black Lotus Labs.

The researchers believe the framework was reserved for selected high-value targets. Operators chain SSH connections through hacked devices, then remove tools, keys and configuration files after sessions typically lasting under 8 hours.

By early 2025, disposable relays operated alongside compromised enterprise systems retained for one to three months. Targets included telecommunications providers, government agencies and utilities. Compromised management platforms enable broad administrative control and access to downstream customers.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/)

---
Canonical: https://techandbusiness.org/newswire/2RgcwUXFccPr8O5MDRN8Sd
Published: 2026-10-28T18:01:28.764Z
Story chronology: 2026-10-28T16:00:00.000Z
Retrieved: 2026-10-28T22:08:48.863Z
Publisher: Tech & Business (techandbusiness.org)