ORB Networks Mask Cyberattacks Using Compromised IoT Devices and SOHO Routers
Operational Relay Box (ORB) networks have been identified as advanced tools utilized by threat actors to conceal cyberattacks from global security teams. These networks comprise compromised Internet-of-Things (IoT) devices, Small Office/Home Office…
Operational Relay Box (ORB) networks have been identified as advanced tools utilized by threat actors to conceal cyberattacks from global security teams. These networks comprise compromised Internet-of-Things (IoT) devices, Small Office/Home Office (SOHO) routers, and Virtual Private Servers working together to mask the origin of malicious activities.
By routing attack traffic through multiple relay points, ORB networks pose a significant challenge for cybersecurity professionals, making it difficult to trace malicious activities back to their source.
The threat became particularly evident when Singapore's Cyber Security Agency disclosed in February 2026 that the state-sponsored group UNC3886 had targeted all four major telecommunications operators in the country. The attackers exploited zero-day vulnerabilities in perimeter firewalls and used advanced rootkits to evade detection while maintaining access to critical infrastructure.
Research by Team Cymru identified several strategic advantages provided by these ORB networks, which traditional methods cannot match.
Operational Relay Box (ORB) networks have been identified as advanced tools utilized by threat actors to conceal cyberattacks from global security teams.
The networks function as private residential proxy services , blending malicious traffic with legitimate user activity. This integration makes blocking efforts risky, as defenders may inadvertently disrupt genuine services while attempting to thwart attacks.
Attack Infrastructure and Pre-Positioning Tactics
The resilience of ORB networks is attributed to their distributed architecture and dynamic composition. Attackers can rapidly scale these networks by adding or removing compromised devices, making them resistant to takedown attempts. If one node is blocked, another can easily replace it, ensuring continuity of operations without significant disruption.
ORB networks are particularly dangerous due to their use in pre-positioning long before actual attacks occur. Adversaries establish these relay infrastructures early, enabling them to conduct reconnaissance and probe target perimeters while maintaining operational security. Routing traffic through nodes geographically close to targets allows attackers to circumvent geofencing controls, making their activities appear more legitimate to security monitoring systems .
Security experts recommend organizations implement proactive threat hunting strategies, behavioral analytics, and Zero Trust security models. Regular router updates, network traffic monitoring, and the integration of advanced threat intelligence are essential protective measures.
Based on reporting by Cyber Security News.