Researchers uncover Volt Typhoon’s covert, ephemeral network

China-linked Volt Typhoon has built a covert, rapidly rotating network of compromised edge devices — dubbed 'Silent Train' — that can be fully rebuilt in under two minutes, with individual sessions lasting only about four hours. This ephemeral design is specifically engineered to defeat traditional detection, attribution, and tracing methods that rely on static indicators of compromise. The group exploited multiple zero-day vulnerabilities across device classes in telecom, energy, defense, and government sectors, demonstrating that unpatched edge devices are a primary attack surface for nation-state actors. The incident matters because critical infrastructure defenders are fighting a moving target: by the time logs are reviewed and alerts fire, the infrastructure has already rotated and evidence has evaporated.