An Operational Relay Box (ORB) network is a sophisticated infrastructure used by cyber threat actors to conduct covert operations, primarily to evade detection, obscure attack origins, and complicate cyber defense efforts via a mesh-like architecture. ORB networks are constructed from a mix of compromised devices—such as routers, Internet of Things (IoT) devices, industrial control systems, and commercially leased virtual private servers (VPS). These devices are often “farmed” by exploiting vulnerabilities in forgotten or unpatched hardware.
How ORB Networks Function
ORB networks create a decentralized mesh of nodes. Traffic is routed through multiple “relay boxes,” with connections occurring between the nodes themselves. This structure makes it difficult to trace the original source of an attack, as the entry and exit points are constantly changing. Each node in the network acts as a proxy, relaying traffic between the attacker’s command-and-control (C2) infrastructure and the intended target. This helps mask the true identity and location of the threat actors.
The lifespan of individual nodes (IP addresses) can be very short—sometimes as brief as 31 days—due to frequent cycling of compromised or leased devices. This rapid turnover further complicates detection and attribution.
ORB networks can be made up of both leased VPS and compromised devices, offering flexibility and resilience. Administrators can easily expand the network by adding new vulnerable devices.
Comparison to Botnets
While ORB networks share similarities with traditional botnets—such as the use of compromised devices—they differ in important ways:
| Feature | Botnet | ORB Network |
|---|---|---|
| Control | Centralized (“bot herder”) | Decentralized or mesh-based |
| Devices | Mostly compromised | Mix of compromised and leased VPS |
| Purpose | DDoS, spam, attacks | Espionage, stealth, obfuscation |
| Traffic Obfuscation | Moderate | High (via multiple relays) |
Why ORB Networks Are Used
ORB networks are particularly favored by state-sponsored actors for cyber espionage. By routing traffic through a complex web of nodes, these networks make it extremely difficult for defenders to identify and block malicious activity, or to attribute attacks to a specific group or country. The use of ORB networks is a growing trend among China-linked advanced persistent threat (APT) groups, who leverage them to conduct long-term intelligence gathering and maintain plausible deniability.