Volt Typhoon, a Chinese state-sponsored hacking group, has been using a framework called Silent Train to run zero-day attacks. The framework relies on rotating chains of compromised SOHO, IoT and enterprise devices that are compromised on demand and then cleaned up after each operation to hide the attack origin. Silent Train acts as a relay infrastructure of compromised devices, allowing the group to pre-position access in "strategic communications, critical infrastructure and other ecosystems" that become essential during geopolitical tensions or crises. The group’s findings show deliberate efforts to maintain access to ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions in the Indo-Pacific region. 1