State-sponsored attackers now reach their targets through networks of hijacked home and small office routers, so the connection that logs in to your VPN looks like an ordinary broadband customer in your own country and the IP address you block today is gone next month. Mandiant calls these operational relay box (ORB) networks; a 16 agency advisory led by the UK NCSC in April 2026 calls them covert networks of compromised devices. This guide explains how ORB networks are built and run, where they appear in intrusions, why static IP blocklists fail against them, and what detection and hardening actually work. It is written for SOC analysts, threat intelligence teams, network engineers and identity owners. For general botnet background see the Botnets Guide, and for the single technique view see the T1090 Proxy Defensive Guide; this page covers the ecosystem.
Key takeaways
- ORB networks are shared, rented infrastructure. They combine leased virtual private servers with compromised routers and IoT devices, some are built by companies rather than by the intrusion team, and several actors use the same network.
- Indicators expire fast. Mandiant observed IPv4 addresses that stayed in an ORB network for as little as 31 days, and the 2026 advisory says static IP blocklists are becoming less effective.
- The exit node is local. Traffic usually leaves the network through a device in the same region as the target, which defeats simple geographic blocking and makes logins look normal.
- Identity is where ORBs hurt most. Microsoft linked a router network of about 8,000 active devices to password spraying that made roughly one attempt per account per day, too slow for per-IP lockout rules.
- Defend with behaviour and baselines. Baseline edge and VPN connections, require phishing-resistant MFA and device certificates for remote access, use dynamic feeds, and replace end of life devices you own.
How the attack works
An ORB network is a proxy mesh. The operator administers it from a control server, customers connect through an entry point, and traffic is relayed across many nodes before it reaches the victim. Mandiant's May 2024 analysis set out a common anatomy, and the 2026 joint advisory describes the same pattern as on-ramp, traversal and exit nodes.
| Component | Mandiant term | What it does | Typical hosting |
|---|---|---|---|
| Control server | Adversary Controlled Operations Server (ACOS) | Administers nodes, pushes implants and configuration | Often PRC or Hong Kong address space, according to Mandiant |
| Entry point | Relay node (on-ramp in the 2026 advisory) | Authenticates the user of the network and hands traffic to the pool | Commonly a leased VPS at a large China or Hong Kong cloud provider |
| Traversal nodes | Traversal nodes | Bulk of the network; relay and hide the origin | Leased VPS, compromised SOHO routers, IoT and smart devices |
| Exit node | Exit or staging node | Last hop into the victim; usually in the target's region | Same as traversal nodes, often residential |
| Victim | Victim server | The target's VPN, mail, identity provider or edge device | Target organisation |
Provisioned, non-provisioned and hybrid
- Provisioned: nodes are leased VPS servers running cloned images. Mandiant's ORB3, tracked as SPACEHOP, is an example, used for scanning and exploitation and linked by Mandiant to APT5 and APT15.
- Non-provisioned: nodes are compromised routers and IoT devices recruited with a router implant. Mandiant's ORB2, FLORAHOX, uses an implant it calls FLOWERWATER on end of life Cisco, ASUS and DrayTek devices, with a Tor relay layer.
- Hybrid: both together. FLORAHOX mixes leased VPS servers with compromised devices and is multi-tenant; Mandiant notes third-party reporting that APT31 and Zirconium use it.
How devices are recruited
Recruitment is mass exploitation of internet-facing devices: known CVEs in routers, cameras, NAS boxes and firewalls, default passwords, and exposed management interfaces. The September 2024 advisory on the Flax Typhoon linked botnet listed 66 CVEs across dozens of vendors, from MikroTik, DrayTek and Zyxel to Fortinet, Ivanti and Citrix. Many recruited devices are end of life and will never receive a fix.
ATT&CK mapping
| Technique | Where it fits in an ORB operation |
|---|---|
| T1584.008 Compromise Infrastructure: Network Devices | Taking over routers and edge devices to become nodes |
| T1584.005 Compromise Infrastructure: Botnet | Running the compromised devices as a managed network |
| T1583.003 Acquire Infrastructure: Virtual Private Server | Leased nodes in provisioned and hybrid networks |
| T1090.003 Proxy: Multi-hop Proxy | Chaining traffic through traversal nodes to the exit node |
| T1595.002 Vulnerability Scanning; T1190 Exploit Public-Facing Application | Reconnaissance and exploitation of victims from ORB nodes |
| T1110.003 Password Spraying; T1078 Valid Accounts; T1133 External Remote Services | Low-and-slow credential attacks and VPN logins that use stolen or sprayed credentials |
The first four IDs are the ones the 2026 joint advisory lists. The rest describe what actors do through the network and are mapped from the reporting cited below.
Where it shows up
| Network or botnet | Linked actor (per source) | Devices | Key facts |
|---|---|---|---|
| KV Botnet | Volt Typhoon (G1017) | Hundreds of US SOHO routers, mostly end of life Cisco and NetGear | Disrupted by a court-authorised US operation in December 2023, announced 31 January 2024. See the Volt Typhoon Threat Actor Profile |
| Raptor Train | Integrity Technology Group; FBI assessed it responsible for Flax Typhoon activity | Over 260,000 devices in June 2024 per the FBI, CNMF and NSA advisory: routers, cameras, DVRs, NAS, firewalls | Mirai-based payload, C2 over TLS on port 443, management servers on TCP 34125. See the Flax Typhoon Threat Actor Profile Guide |
| CovertNetwork-1658 (also called xlogin and Quad7) | Maintained by a China-based actor per Microsoft; credentials used by Storm-0940 and others | Mostly TP-Link SOHO routers | Shell on TCP 7777, SOCKS5 proxy on TCP 11288; about 8,000 active devices, about 20% spraying at any time |
| SPACEHOP (ORB3) | APT5 and APT15 per Mandiant | Provisioned VPS nodes | A SPACEHOP node was used to exploit CVE-2022-27518 in Citrix ADC in December 2022. See the APT5 Threat Actor Profile Guide |
| FLORAHOX (ORB2) | Multi-tenant; APT31 and Zirconium reported as users | Compromised routers and IoT plus VPS and Tor | See the APT31 Threat Actor Profile Guide |
| Moobot botnet | Repurposed by GRU Unit 26165 (APT28, G0007) | Ubiquiti EdgeOS routers still on default admin passwords | Operation Dying Ember, announced 15 February 2024. See the APT28 (Fancy Bear) Threat Actor Profile |
The pattern is not limited to China-nexus actors, as the Moobot case shows, but the 2026 advisory states that a majority of China-nexus actors now use covert networks, strategically and at scale.
Impact
- Blocklists stop working: each network can have hundreds of thousands of endpoints that change as devices are patched, rebooted or replaced, and Mandiant reports that Chinese ORB contractors compete on how much infrastructure they can cycle each month.
- Attribution gets harder: the same exit node may serve several actors and, according to the 2026 advisory, some legitimate customers. An IP address tells you which network, not which actor.
- Geographic controls are bypassed: exit nodes in the target's region make impossible travel and country blocking much weaker.
- Identity attacks become quiet: distributed, low volume password spraying slips under per-IP and per-account thresholds.
- Your devices become someone else's infrastructure: an unpatched branch router or camera can relay attacks on others, with legal and reputational consequences and possible disruption by law enforcement.
Detection
What to monitor
- Remote access baselines: the advisory's first step is to baseline normal connections to corporate VPNs and other remote access, and to question connections from consumer broadband ranges, especially to administrative accounts.
- Identity provider sign-ins: failed sign-ins aggregated by ISP or ASN rather than by IP. Microsoft's hunting query flags an ISP with failed sign-ins against at least 100 accounts from at least 5 countries and 25 IP addresses in four hours.
- Infrastructure fingerprints: track known networks by service banners and certificates, not only by IP, as the 2026 advisory recommends. Unexpected services such as SOCKS proxies on high ports are a giveaway on nodes.
- Flow data: NetFlow or IPFIX lets you look upstream from a suspect connection and find other nodes in the same network. See the NetFlow and IPFIX Flow Telemetry Guide.
- Your own edge devices: new listening ports, outbound connections from routers or cameras, configuration changes and reboots you did not schedule may mean your device is a node.
Metrics that show it is working
- Remote access coverage: percentage of VPN and remote access logins protected by phishing-resistant MFA and device certificates.
- Feed freshness: median age of IP indicators in active block rules (target: days, not months).
- Baseline alerts triaged: number of remote access logins from residential ranges reviewed per week, and the share confirmed benign.
- End of life exposure: count of internet-facing devices owned by you that are past vendor support.
- Spray detection: time from the first distributed spray attempt to an alert, measured with an internal test.
Prevention and hardening
Rollout in order
- Map your edge: inventory every internet-facing device and service, including branch routers and cameras, and flag end of life items. The Edge Device Security Guide covers hardening.
- Close the identity gap: enforce MFA without exclusions on remote access and the identity provider, disable legacy authentication that cannot enforce MFA, and add password protection lists. Pilot conditional access in report-only mode where supported, then enforce; roll back per policy if a business flow breaks.
- Bind access to devices: for VPN and administrative access, require machine certificates so a valid password from an unknown device fails. See the Secure Remote Access Beyond VPN Guide.
- Switch to dynamic feeds: replace static IP lists with feeds that expire indicators and include known covert network nodes; alert first, block after a week of tuning. See the Threat Intelligence Feed Evaluation Guide.
- Add allowlists where the population is known: IP or profile-based allowlists for administrator and third-party VPN access, which the advisory recommends for larger or higher risk organisations.
- Replace end of life devices: the KV Botnet and Raptor Train both relied on unsupported devices. Use the Edge Device End of Life Replacement Playbook; where replacement must wait, reduce exposure (management interfaces off the internet, unused services and UPnP disabled, default passwords changed, scheduled reboots).
Decision guidance by organisation size
| Tier (2026 advisory) | Priority actions | Trade-off |
|---|---|---|
| All organisations | Map edge devices, baseline connections, dynamic feeds, MFA on remote access | Low cost; most value comes from MFA and inventory |
| Larger or more at risk | IP or profile allowlists for VPN, zero trust policies, machine certificates, reduced internet exposure, anomaly detection | Allowlists need upkeep for travelling staff and suppliers |
| Largest or most at risk | Track covert networks as adversaries in their own right, active hunting, NetFlow analysis, network mapping | Needs a threat intelligence function and data access; overkill for most |
Blocking all residential ranges is tempting but usually wrong for organisations with home workers; it is more practical to require device-bound authentication and to scrutinise residential connections to privileged accounts.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Edge device inventory and end of life | ID.AM-01, ID.RA-01 | CM-8, SA-22, SI-2 |
| Remote access and boundary protection | PR.IR-01 | AC-17, SC-7 |
| Strong authentication for remote users | PR.AA-03 | IA-2 |
| Network monitoring and analysis | DE.CM-01, DE.AE-02 | SI-4 |
Lessons from incidents
No breach in the NHI Mgmt Group database is publicly tied to a specific ORB network, so these lessons come from government operations and vendor reporting.
- Disruption is temporary: the FBI warned that rebooting a router cleaned in the KV Botnet operation reverses the temporary protection, and that factory resetting an EdgeRouter from Operation Dying Ember without changing the default password exposes it again. Replacement and hardening are the fix, not takedowns.
- Exposure shifts, it does not end: after public reporting by Sekoia and Team Cymru in 2024, Microsoft saw CovertNetwork-1658's original infrastructure decline and assessed that operators were acquiring new infrastructure with modified fingerprints.
- Credentials move fast: Microsoft observed Storm-0940 using credentials from CovertNetwork-1658 spraying on the same day they were obtained. Spray detection has to feed account reset within hours.
- Edge exploitation and ORBs go together: the SPACEHOP use against Citrix ADC shows ORB nodes as the launch point for edge exploitation. See the Edge Device Exploitation by Threat Actors Guide.
Common failure patterns
- Treating a blocked IP as a closed case instead of asking which network it belongs to and who else uses it.
- Lockout and alert rules keyed only on failed attempts per IP or per account.
- MFA exclusions for service, break-glass or legacy protocol accounts that sprayers then target.
- Branch routers and cameras missing from the asset inventory, so nobody notices they are end of life.
- Relying on country blocking while exit nodes sit in the same country as the target.
Practitioner checklist
- Baseline VPN and remote access connections and alert on residential ranges reaching admin accounts.
- Aggregate failed sign-ins by ISP and ASN to catch distributed spraying.
- Enforce MFA without exclusions on remote access and disable legacy authentication.
- Require device certificates for VPN and administrative access.
- Replace static IP blocklists with expiring, dynamic feeds that include covert network indicators.
- Inventory every internet-facing device you own and schedule replacement of end of life models.
- Remove management interfaces from the internet and change every default password.
- Retain NetFlow or IPFIX for edge links long enough to investigate upstream.
- Track known ORB networks by banners and certificates in your threat intelligence platform.
Standards and references
- NCSC-UK and partners: Defending Against China-Nexus Covert Networks of Compromised Devices
- NCSC: Executive Summary, Defending Against China-Nexus Covert Networks
- FBI, CNMF, NSA and partners: PRC-Linked Actors Compromise Routers and IoT Devices for Botnet Operations
- US Department of Justice: U.S. Government Disrupts Botnet PRC Used to Conceal Hacking of Critical Infrastructure
- Google Cloud Mandiant: IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks
- Microsoft Threat Intelligence: Storm-0940 Uses Credentials from Password Spray Attacks from a Covert Network
- CISA: Secure by Design Alert, Security Design Improvements for SOHO Device Manufacturers
- MITRE ATT&CK: Compromise Infrastructure: Network Devices (T1584.008)
Related NHI Mgmt Group resources: Botnets Guide · T1090 Proxy Defensive Guide · Edge Device Security Guide · Volt Typhoon Threat Actor Profile · SOHO and SMB Router Hardening Guide