# Operational Relay Box (ORB) Networks - PRC-Linked Obscured Infrastructure Built on Unpatched and Forgotten Devices

> Operational Relay Box (ORB) networks are meshes of leased VPS hosts and compromised, often end-of-life IoT/SOHO devices that relay traffic through rotating exit nodes to hide attacker origin. Team Cymru, Mandiant and a September 2024 FVEY advisory tie ORB networks (SPACEHOP, FLORAHOX, Raptor Train) to PRC-nexus actors including Flax Typhoon, APT5, APT15 and APT31.

- **Published:** 2026-10-27T00:51:59Z
- **Last reviewed:** 2026-10-27T00:51:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4500
- **ID:** TL-2026-4500
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-27518

## Description

Team Cymru's S2 Research Team (29 Oct 2024) describes an Operational Relay Box (ORB) network as the 'love child' of a VPN and a botnet: a mesh of virtual private servers procured by the operator and/or compromised IoT devices (routers, industrial control systems, healthcare devices, residential and commercial broadband gear) that communicate with one another and route traffic through multiple relay points with randomized or alternating exit nodes. Because exit nodes frequently sit on residential or commercial IP space without a dedicated public address, malicious traffic blends with the legitimate activity of many users. Operators recruit 'forgotten or unpatched devices' using ordinary botnet infection techniques. Team Cymru notes ORB networks are historically associated with state-sponsored activity, are frequently attributed to PRC entities, and are increasingly adopted by financially motivated actors.

Mandiant (Google Cloud, May 2024) classifies ORB networks as provisioned (commercially leased VPS managed by ORB administrators, e.g. ORB3/SPACEHOP, active since at least 2019), non-provisioned (compromised end-of-life routers and IoT devices, e.g. ORB1/ORBWEAVER active since at least 2020 and ORB2/FLORAHOX built from Cisco, ASUS and Draytek routers recruited by the FLOWERWATER implant, with PETALTOWER and SHIMMERPICK tooling identified in January 2023), or hybrid. A generic ORB anatomy comprises an Adversary Controlled Operations Server (ACOS) and relay nodes typically hosted in PRC/Hong Kong IP space, traversal nodes, and exit/staging nodes that egress to the victim, often geographically close to the target. ORBs are multi-tenanted: SPACEHOP was used by APT5, APT15 and UNC2630 (exploitation of Citrix ADC CVE-2022-27518 in December 2022); FLORAHOX by APT5, APT31 and Zirconium. Infrastructure cycles quickly (some IPv4 addresses live as short as 31 days), so single-IP IOCs are ephemeral and Mandiant recommends tracking ORBs as evolving entities.

The 18 September 2024 joint FVEY advisory documents the Raptor Train botnet, attributed to Flax Typhoon and operated by Integrity Technology Group, a PRC company with government ties. Black Lotus Labs reports 200,000+ SOHO routers, NVR/DVR devices, NAS servers and IP cameras compromised since 2020 (peak ~60,000 active devices in June 2023) with a Mirai-derived in-memory implant, Nosedive, a three-tier architecture (Tier 1 bots, Tier 2 exploitation/payload/C2 servers, Tier 3 management nodes running the Sparrow/NCCT Electron application), and four campaigns (Crossbill, Finch, Canary, Oriole) using the C2 root domains k3121.com, b2047.com and w8510.com. Observed targeting was U.S. and Taiwanese military, government, higher education, telecommunications, defense industrial base and IT entities, with scanning of Atlassian Confluence and Ivanti Connect Secure; no DDoS was observed. The FBI disrupted the botnet under a court-authorized operation.

Defensive implications per Team Cymru: reconnaissance, exploitation, C2 and exfiltration can all be routed through obscured exit nodes; hunt for unlikely communication between geographically distant similar devices, high outbound volumes, relaying across multiple locations, connections to unfamiliar IPs over unusual protocols, and X.509 certificate pivots; apply behavioral analytics, threat-intel feeds, zero trust with microsegmentation and MFA. Blocking residential ranges risks collateral damage and operators may patch compromised devices post-compromise, obscuring forensics.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1584.008 Network Devices
- T1584.005 Botnet
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1090.003 Multi-hop Proxy
- T1090.002 External Proxy
- T1665 Hide Infrastructure

## Sources

- [An Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and Obscured](https://www.team-cymru.com/post/an-introduction-to-operational-relay-box-orb-networks-unpatched-forgotten-and-obscured)
- [Mandiant: China-Nexus Espionage Actors Use ORB Networks](https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks)
- [FBI/FVEY Joint Advisory on PRC-linked Botnet (Integrity Technology Group / Flax Typhoon)](https://www.ic3.gov/Media/News/2024/240918.pdf)
- [New Raptor Train IoT Botnet Compromises Over 200,000 Devices Worldwide](https://thehackernews.com/2024/09/new-raptor-train-iot-botnet-compromises.html)
- [FBI forced Flax Typhoon to abandon its botnet](https://www.helpnetsecurity.com/2024/09/19/flax-typhoon-botnet-disrupted/)
- [Raptor Train IoT botnet IOC advisory](https://rewterz.com/threat-advisory/over-200000-devices-worldwide-compromised-by-new-raptor-train-iot-botnet-active-iocs)
- [Chinese Hackers Rely on Covert Proxy Networks to Evade Detection](https://www.infosecurity-magazine.com/news/chinese-apt-orb-networks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4500