ORBs: Hacking groups’ new favourite way of keeping their attacks hidden

Cyber-espionage groups are making it harder to spot where their attacks are coming from by upping their usage of proxy networks – known as operational relay box networks or ORBs – that can throw defenders off the scent.

Cyber security company Mandiant has warned that it has seen a growing trend for China-backed espionage operations, in particular, to use ORBs to cover their tracks.

These ORB networks are somewhat like botnets and can be made up of virtual private servers (VPS), as well as compromised internet of things (IoT) devices and insecure routers. This combination makes it harder for defenders to track attacks because these groups can disguise traffic between their command-and-control infrastructure and their final targets.

ORB networks are one of the major innovations in Chinese cyber espionage that are challenging defenders, said Michael Raggi, Mandiant principal analyst at Google Cloud.

“They’re like a maze that is continually reconfiguring with the entrance and the exit disappearing from the maze every 60 to 90 days,” he said. “To target someone, these actors may be coming from a home router right down the street. It’s not unusual for an entirely unwitting person’s home router to be involved in an act of espionage.” 

These networks are often built by renting VPS and using malware designed to target routers to grow the number of devices capable of relaying traffic. Because the makeup of these networks changes rapidly, using an ORB network makes it harder to spot attacks and pin them on a particular group in terms of attribution.

That makes classic indicators of compromise (IOC) – the tech details and clues commonly shared about attacks – less useful because these groups will regularly cycle through network infrastructure.

The scale of these networks, Mandiant said, means attackers can piggyback on devices that have a handy geographic proximity to targeted enterprises. That allows their malicious traffic to blend in when being reviewed by analysts.

“One such example would be traffic from a residential ISP that is in the same geographic location as the target that is regularly used by employees and would be less likely to get picked up for…