Full Report
IntroductionThe modern cyber threat landscape has seen a fundamental shift in how threat actors manage and deploy their infrastructure. Advanced persistent threats (APTs) have almost completely moved away from static command-and-control (C2) servers, opting instead to build complex, multi-layered botnets known as Operational Relay Box (ORB) networks. Project ORBITAL (which stands for Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) was established as a centralised intelligence matrix to track, analyse, and ultimately help defenders disrupt this highly evasive infrastructure.To construct these networks, adversaries systematically compromise unpatched, end-of-life devices. By targeting legacy, unpatched Small Office/Home Office (SOHO) router and Internet-of-Things (IoT) devices attackers can create a sprawling, decentralised mesh of proxy nodes. By routing their operations through layers of compromised devices, adversaries mask their true origins, making malicious activity blend seamlessly with legitimate regional traffic.Blogs by my colleagues at Team Cymru as well as Google offer detailed explanations as to why and how these ORBs have grown over many years and continue to expand.Project BackgroundProject ORBITAL represents a centralised Open Source Intelligence (OSINT) collection driven by public reporting from advanced research teams across the cybersecurity and technology sectors. This initiative aggregates telemetry and findings from top-tier vendors including Cisco Talos, CrowdStrike, Google, GreyNoise Labs, Lumen Black Lotus Labs, Microsoft, SecurityScorecard, Sekoia, SentinelLabs, Sygnia, and Team Cymru. Furthermore, it incorporates critical alerts and intelligence shared publicly by United States government agencies, specifically the Federal Bureau of Investigation (FBI), the Cyber National Mission Force (CNMF), and the National Security Agency (NSA).This repository builds on the methodology of my previous OSINT tracking initiatives. It is heavily inspired by the structure and community success of my earlier matrix projects, specifically the Ransomware Tool Matrix (RTM) (here), the Ransomware Vulnerability Matrix (RVM) (here), and the Russian APT Tool Matrix (RUTM) (here). By applying a similar, structured approach to mapping Operational Relay Box (ORB) networks, this project aims to provide defenders with a clear, actionable lexicon for hunting and tracking evasive edge-device botnets.Graph VisualisationOnce Project ORBITAL was initially assembled, it was then possible to use a GitHub Action automation with NetworkX and PyVis to create a Graph Visualisation using the data collected. Once in this view, some interesting patterns could be observed.Analysis of the extracted data uncovered that ASUS devices were the most targeted out of all of the targeted devices by ORBs from the public reports.Another interesting point the graph highlighted is that the LapDogs ORB network had the highest number of reported targeted devices. In most reported scenarios, a singular threat group used a dedicated ORB network. However, from extracting the details from the Google and SentinelLabs reports, an adversary like APT15, reportedly leverages both SPACEHOP and PurpleHaze ORB networks, alongside two other separate adversaries UNC2630 and UNC5174.The overlap in ORB usage suggests these APTs aren't all building their own botnets from scratch. These overlaps likely indicate there are provisioning teams, such as specialised contractors, like Beijing Integrity Tech, who build and maintain these ORB networks and then lease access to the broader Chinese intelligence community in the Ministry of State Security (MSS) and People’s Liberation Army (PLA).Panda-moniumBelow is the list of well-known China-nexus APTs listed using CrowdStrike’s naming scheme and their Google or Microsoft aliases that are all mentioned in Project ORBITAL.CAULDRON PANDA (aka UNC3886)ETHEREAL PANDA (aka Flax Typhoon)JUDGMENT PANDA (APT31, Violet Typhoon)KEYHOLE PANDA (aka UNC2630, APT5)MURKY PANDA (aka Silk Typhoon)VANGUARD PANDA (aka Volt Typhoon)VIXEN PANDA (aka APT15, Nylon Typhoon) The most notable aspect about this list is that it contains APTs with wildly different mandates. VANGUARD PANDA (Volt Typhoon) is famous for pre-positioning within critical infrastructure with the potential disruptive attacks, while KEYHOLE PANDA (APT5) and JUDGMENT PANDA (APT31) are long-running cyber-espionage and IP theft operators. The fact that both the saboteurs and the spies have all adopted ORB networks goes to show that this tactic is not niche but instead is the baseline standard for Chinese APT operational security (OPSEC).How to AccessYou can find Project ORBITAL on my GitHub repository below:
Analysis Summary
# Tool/Technique: Operational Relay Box (ORB) Networks
## Overview
Operational Relay Box (ORB) networks represent a fundamental shift in threat actor infrastructure. Instead of relying on static command-and-control (C2) servers, Advanced Persistent Threats (APTs) build complex, multi-layered botnets comprised of compromised edge devices. The primary purpose of an ORB is to act as a decentralized mesh of proxy nodes that masks the adversary's true origin by blending malicious traffic with legitimate regional internet traffic.
## Technical Details
- **Type**: Infrastructure Technique / Botnet
- **Platform**: Small Office/Home Office (SOHO) routers (notably ASUS), Internet-of-Things (IoT) devices, and End-of-Life (EoL) legacy hardware.
- **Capabilities**: Proxying traffic, traffic relaying, multi-hop obfuscation, and regional traffic blending.
- **First Seen**: Ongoing; Project ORBITAL tracks these as the modern baseline for Chinese APT operational security (OPSEC).
## MITRE ATT&CK Mapping
- **TA0011 - Command and Control**
- **T1090.002 - Proxy: External Proxies**
- **T1090.003 - Proxy: Multi-hop Proxy**
- **TA0001 - Initial Access**
- **T1190 - Exploit Public-Facing Application** (used to compromise the SOHO/IoT devices)
- **TA0005 - Defense Evasion**
- **T1535 - Unused/Unsupported Cloud Regions** (Related to infrastructure obfuscation)
## Functionality
### Core Capabilities
- **Traffic Masking**: Routes malicious operations through layers of compromised devices to obscure the source IP of the attacker.
- **Regional Blending**: Uses IP addresses within the same geographic region as the target to avoid "impossible travel" alerts or geo-blocking.
- **Decentralized Mesh**: Utilizes a sprawling network of nodes rather than a single point of failure.
### Advanced Features
- **Leased Infrastructure**: Certain ORB networks are maintained by specialized contractors (e.g., Beijing Integrity Tech) and leased as a service to various intelligence agencies (MSS/PLA).
- **Automated Provisioning**: Use of specialized teams to build and maintain the botnet "nodes" so that espionage and sabotage groups can focus on primary objectives.
## Indicators of Compromise
- **File Hashes**: N/A (Infrastructure-based; varies by specific malware used to enlist nodes).
- **File Names**: N/A
- **Registry Keys**: N/A
- **Network Indicators**:
- Hostnames/IPs associated with **SPACEHOP** ORB
- Hostnames/IPs associated with **PurpleHaze** ORB
- Hostnames/IPs associated with **LapDogs** ORB (reported as having the highest number of targeted devices).
- **Behavioral Indicators**:
- Unusual traffic originating from ASUS SOHO routers and EoL IoT devices.
- Proxy traffic patterns on non-standard ports from residential/small business IP ranges.
## Associated Threat Actors
- **VANGUARD PANDA** (Volt Typhoon)
- **VIXEN PANDA** (APT15, Nylon Typhoon)
- **KEYHOLE PANDA** (UNC2630, APT5)
- **JUDGMENT PANDA** (APT31, Violet Typhoon)
- **CAULDRON PANDA** (UNC3886)
- **ETHEREAL PANDA** (Flax Typhoon)
- **MURKY PANDA** (Silk Typhoon)
- **UNC5174**
## Detection Methods
- **Behavioral Detection**: Monitoring for anomalous outbound traffic from edge devices, specifically looking for proxy-like behavior on SOHO and IoT hardware.
- **Telemetry Analysis**: Aggregating global telemetry to identify clusters of compromised residential IPs acting as relays.
- **Graph Analysis**: Utilizing tools like Project ORBITAL to identify overlaps between known ORB nodes and suspected APT activity.
## Mitigation Strategies
- **Hardware Refresh**: Replace End-of-Life (EoL) devices that no longer receive security patches.
- **Vulnerability Management**: Rigorous patching of external-facing SOHO and IoT devices (specifically ASUS and similar router brands).
- **Network Segmentation**: Isolate IoT and edge devices from critical internal segments to prevent lateral movement if a node is compromised.
- **Access Control**: Disable remote management interfaces on routers unless absolutely necessary and protect them with MFA.
## Related Tools/Techniques
- **Ransomware Tool Matrix (RTM)**: Predecessor OSINT project.
- **Russian APT Tool Matrix (RUTM)**: Related infrastructure tracking project.
- **Proxying**: The foundational technique used by ORBs.