Threat reportAPTTL-2026-4500
Operational Relay Box (ORB) Networks - PRC-Linked Obscured Infrastructure Built on Unpatched and Forgotten Devices
Operational Relay Box (ORB) Networks (TL-2026-4500), also tracked as ORB networks, is a high-severity advanced persistent threat campaign, first published 2026-10-27. It is linked to a China-nexus actor with medium confidence, affects Multiple SOHO routers, NVR/DVR, NAS servers and IP cameras (ActionTec, references 1 CVE (CVE-2022-27518), maps to 9 MITRE ATT&CK techniques (T1059.004, T1090.002, T1090.003), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-4500
- Threat ID
- TL-2026-4500
- Also known as
- ORB networks, Operational Relay Box, ORB1/ORBWEAVER, ORB2/FLORAHOX, ORB3/SPACEHOP, Raptor Train
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, military, higher education, telecoms, defense industrial base, information technology
- Target regions
- united states of america, taiwan, Europe, Middle East
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Operational Relay Box (ORB) Networks
Malware and tooling: FLOWERWATER, Nosedive, PETALTOWER, SHIMMERPICK, Sparrow (Node Comprehensive Control Tool, NCCT)
How Operational Relay Box (ORB) Networks works
Operational Relay Box (ORB) networks are meshes of leased VPS hosts and compromised, often end-of-life IoT/SOHO devices that relay traffic through rotating exit nodes to hide attacker origin. Team Cymru, Mandiant and a September 2024 FVEY advisory tie ORB networks (SPACEHOP, FLORAHOX, Raptor Train) to PRC-nexus actors including Flax Typhoon, APT5, APT15 and APT31.
Team Cymru's S2 Research Team (29 Oct 2024) describes an Operational Relay Box (ORB) network as the 'love child' of a VPN and a botnet: a mesh of virtual private servers procured by the operator and/or compromised IoT devices (routers, industrial control systems, healthcare devices, residential and commercial broadband gear) that communicate with one another and route traffic through multiple relay points with randomized or alternating exit nodes. Because exit nodes frequently sit on residential or commercial IP space without a dedicated public address, malicious traffic blends with the legitimate activity of many users. Operators recruit 'forgotten or unpatched devices' using ordinary botnet infection techniques. Team Cymru notes ORB networks are historically associated with state-sponsored activity, are frequently attributed to PRC entities, and are increasingly adopted by financially motivated actors.
Mandiant (Google Cloud, May 2024) classifies ORB networks as provisioned (commercially leased VPS managed by ORB administrators, e.g. ORB3/SPACEHOP, active since at least 2019), non-provisioned (compromised end-of-life routers and IoT devices, e.g. ORB1/ORBWEAVER active since at least 2020 and ORB2/FLORAHOX built from Cisco, ASUS and Draytek routers recruited by the FLOWERWATER implant, with PETALTOWER and SHIMMERPICK tooling identified in January 2023), or hybrid. A generic ORB anatomy comprises an Adversary Controlled Operations Server (ACOS) and relay nodes typically hosted in PRC/Hong Kong IP space, traversal nodes, and exit/staging nodes that egress to the victim, often geographically close to the target. ORBs are multi-tenanted: SPACEHOP was used by APT5, APT15 and UNC2630 (exploitation of Citrix ADC CVE-2022-27518 in December 2022); FLORAHOX by APT5, APT31 and Zirconium. Infrastructure cycles quickly (some IPv4 addresses live as short as 31 days), so single-IP IOCs are ephemeral and Mandiant recommends tracking ORBs as evolving entities.
The 18 September 2024 joint FVEY advisory documents the Raptor Train botnet, attributed to Flax Typhoon and operated by Integrity Technology Group, a PRC company with government ties. Black Lotus Labs reports 200,000+ SOHO routers, NVR/DVR devices, NAS servers and IP cameras compromised since 2020 (peak ~60,000 active devices in June 2023) with a Mirai-derived in-memory implant, Nosedive, a three-tier architecture (Tier 1 bots, Tier 2 exploitation/payload/C2 servers, Tier 3 management nodes running the Sparrow/NCCT Electron application), and four campaigns (Crossbill, Finch, Canary, Oriole) using the C2 root domains k3121.com, b2047.com and w8510.com. Observed targeting was U.S. and Taiwanese military, government, higher education, telecommunications, defense industrial base and IT entities, with scanning of Atlassian Confluence and Ivanti Connect Secure; no DDoS was observed. The FBI disrupted the botnet under a court-authorized operation.
Defensive implications per Team Cymru: reconnaissance, exploitation, C2 and exfiltration can all be routed through obscured exit nodes; hunt for unlikely communication between geographically distant similar devices, high outbound volumes, relaying across multiple locations, connections to unfamiliar IPs over unusual protocols, and X.509 certificate pivots; apply behavioral analytics, threat-intel feeds, zero trust with microsegmentation and MFA. Blocking residential ranges risks collateral damage and operators may patch compromised devices post-compromise, obscuring forensics.
MITRE ATT&CK techniques used in TL-2026-4500
Execution
Command and Control
T1090.002 External Proxy; T1090.003 Multi-hop Proxy; T1665 Hide Infrastructure
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
T1583.003 Virtual Private Server; T1584.005 Botnet; T1584.008 Network Devices
Reconnaissance
Affected products and versions in Operational Relay Box (ORB) Networks
- Multiple — SOHO routers, NVR/DVR, NAS servers and IP cameras (ActionTec, ASUS, DrayTek, Fujitsu, Hikvision, MikroTik, Mobotix, Panasonic, QNAP, Ruckus Wireless, Shenzhen TVT, Synology, Tenda, TOTOLINK, TP-LINK, Zyxel)
Vulnerable versions: Unpatched and end-of-life firmware - Cisco, ASUS, Draytek — End-of-life routers recruited into ORB2/FLORAHOX
Vulnerable versions: End-of-life models - Citrix — Citrix ADC/Gateway (CVE-2022-27518, exploited via SPACEHOP node)
Vulnerable versions: Per vendor advisory
Fixed in: Per vendor advisory
Remediation for Operational Relay Box (ORB) Networks
Patches
- Apply vendor firmware updates for ActionTec, ASUS, DrayTek, Hikvision, MikroTik, QNAP, Synology, TP-LINK, Zyxel and other affected edge devices
- Apply Citrix fix for CVE-2022-27518
Immediate actions
- Hunt for connections to known ORB infrastructure (Raptor Train C2 domains w8510.com, b2047.com, k3121.com) and for unlikely communication between geographically distant similar devices
- Reboot and patch or replace internet-facing SOHO routers, NVR/DVR, NAS and IP cameras; Nosedive has no reboot persistence
- Hunt for high outbound traffic volumes, multi-location data relaying and connections to unfamiliar IPs over unusual protocols
Workarounds
- Do not expose device management interfaces to the internet
- Treat residential-range IP blocking cautiously due to collateral damage; prefer behavioral and certificate-based detection
Longer-term hardening
- Retire end-of-life routers and IoT devices that no longer receive patches
- Integrate threat-intelligence feeds that tag ORB networks and track them as evolving entities rather than static IP lists
- Adopt zero trust architecture with microsegmentation and MFA
- Deploy behavioral network analytics to flag anomalous relay routing
CVEs associated with Operational Relay Box (ORB) Networks
Timeline of Operational Relay Box (ORB) Networks
- ORB3/SPACEHOP provisioned ORB network active since at least 2019 (year precision per Mandiant)
- Raptor Train 'Crossbill' campaign begins using k3121.com C2 root domain (May 2020 - Apr 2022)
- Raptor Train 'Finch' campaign begins using b2047.com (Jul 2022 - Jun 2023)
- UNC2630 uses a SPACEHOP node to exploit Citrix ADC CVE-2022-27518 (month precision)
- PETALTOWER MIPS tunneler and SHIMMERPICK identified in ORB2/FLORAHOX (month precision)
- Raptor Train 'Canary' campaign (May - Aug 2023) using b2047.com
- Raptor Train peaks at ~60,000 active devices; 'Oriole' campaign begins using w8510.com (Jun 2023 - Sep 2024)
- Mandiant publishes research on China-nexus ORB networks (month precision)
- FVEY joint advisory on Integrity Technology Group / Flax Typhoon botnet; FBI-authorized court operation disrupts Raptor Train infrastructure
- Team Cymru S2 publishes introduction to ORB networks
Sources cited for Operational Relay Box (ORB) Networks
- An Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and Obscured
- Mandiant: China-Nexus Espionage Actors Use ORB Networks
- FBI/FVEY Joint Advisory on PRC-linked Botnet (Integrity Technology Group / Flax Typhoon)
- New Raptor Train IoT Botnet Compromises Over 200,000 Devices Worldwide
- FBI forced Flax Typhoon to abandon its botnet
- Raptor Train IoT botnet IOC advisory
- Chinese Hackers Rely on Covert Proxy Networks to Evade Detection
Detection coverage for TL-2026-4500
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4500 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.