Zero Radar
← feed
HighSecurity incidentupdated 28 Oct 2026, 18:48 UTC

Chinese state hackers hide zero-day attacks behind rotating device chains

A state-sponsored hacking group is routing its attacks through chains of hijacked routers, cameras and other small devices, which makes the attacks hard to trace. The group has used this method to exploit previously unknown security flaws.

Attacks reported (BleepingComputer, The Hacker News)2 independent sources
SeverityHighSecurity incident
Being exploited?ReportedBy BleepingComputer, The Hacker News, not officially confirmed yet
What to doCheck exposureAudit and update internet-facing routers and IoT devices, and check them for signs of compromise.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Volt Typhoon operatorChina-nexus espionage group
  2. 2Rotating device chainCompromised SOHO and IoT devices relay traffic
  3. 3Zero-day exploitPreviously unknown flaw used against target
  4. 4Strategic accessCovert access to high-value systems
  5. ResultAttacker gains hidden access to high-value systems

What happened

Volt Typhoon, a China-nexus espionage group, used a covert network called Silent Train built from rotating chains of compromised SOHO, IoT and enterprise devices to carry out zero-day exploitation campaigns; the network has since been disrupted.

Why it is dangerous: The attackers aim at high-value systems and hide their origin behind compromised third-party devices, so organizations and their defenders may struggle to detect or attribute intrusions.

Are you affected?

You are affected if you run internet-facing SOHO routers, IoT devices or enterprise infrastructure that could be compromised and used as relay nodes, or if you operate high-value systems that this group targets.

What to do

  1. Review internet-facing routers, IoT devices and edge equipment for unexpected configuration changes or unknown access, and update their firmware.
  2. Replace or retire end-of-life SOHO and IoT devices that no longer receive security updates.
  3. Monitor logs for unusual inbound and outbound connections from edge devices, which may indicate relay use.

Timeline

  1. 28 Oct 2026, 16:00 UTC
    Publicly disclosed
  2. 28 Oct 2026, 16:00 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 28 Oct 2026, 16:08 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 18:48 UTC
    The Hacker News reported on it · The Hacker News

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-6e5b3419
Disclosed
28 Oct 2026, 16:00 UTC
On Zero Radar
28 Oct 2026, 16:08 UTC (9 min after disclosure)
Last change
28 Oct 2026, 18:48 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Chinese state hackers hide zero-day attacks behind rotating device chains · Zero Radar