Volt Typhoon uses ephemeral infrastructure for zero-day attacks

Volt Typhoon, a China-backed state group, uses rapidly rotated compromised SOHO routers and IoT devices to infiltrate U.S. critical infrastructure. Black Lotus Labs reports the "Silent Train" framework assembles and dismantles malicious chains daily, sometimes rebuilding in under two minutes. The group exploits zero-days and network edge vulnerabilities to achieve persistent access in hundreds of sensitive systems.