FlagThis — Daily Cybersecurity Intelligence Briefing

Volt Typhoon, a China-nexus state-sponsored APT, has operated the Silent Train covert relay network for at least three years to conceal zero-day exploitation and persistent access across U.S. government, defense, and critical infrastructure. The actor chains compromised SOHO/IoT devices (TP-Link, Netgear Orbi, Intelbras) and enterprise systems (Fortinet, Cisco, PRTG, CyberPanel, Mirth Connect) using at least four confirmed and one likely zero-day. Transient proxy chains are assembled in under two minutes via Chisel and FRP reverse tunneling, layered across VPS providers, and dismantled post-operation to evade detection and takedowns. Access is pre-positioned for potential Indo-Pacific crisis disruption.