Chinese-linked hacking units increasingly use \u2018ORBs\u2019 to obfuscate espionage, researchers say | CyberScoop<\/title> <meta name=\"description\" content=\"Scores of purchased or compromised devices used in \u201coperational relay box networks\u201d make detection and defense harder.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/china-hacking-operational-relay-box-networks\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Chinese-linked hacking units increasingly use \u2018ORBs\u2019 to obfuscate espionage, researchers say\"> <meta property=\"og:description\" content=\"Scores of purchased or compromised devices used in \u201coperational relay box networks\u201d make detection and defense harder.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/china-hacking-operational-relay-box-networks\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-05-22T14:00:00+00:00\"> <meta property=\"article:modified_time\" content=\"2024-05-21T22:07:13+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1282\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1715117951g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1715115084g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1716385020g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/80482\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.5.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=80482\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-hacking-operational-relay-box-networks%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-hacking-operational-relay-box-networks%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-80482 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/china-hacking-operational-relay-box-networks\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.749249249249\">\n<div class=\"single-article__header-content\" readability=\"30.196911196911\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/cybersecurity\/\"> <span>Cybersecurity<\/span> <\/a> <\/li>\n<\/ul>\n<p> Scores of purchased or compromised devices used in \u201coperational relay box networks\u201d make detection and defense harder. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"427\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say.jpg?resize=640%2C427&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=768,513 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=1024,684 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=1536,1026 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=600,401 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=1011,675 1011w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-2.jpg?resize=1263,843 1263w\" sizes=\"(max-width: 1011px) 100vw, 1011px\"><figcaption> Internet connector into a LAN router switch. (Yori Meirizan\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"45.142985007832\"><body readability=\"91.343114055845\"><\/p>\n<p>Successfully tracking Chinese-linked cyber espionage operations is becoming increasingly difficult as Beijing\u2019s hackers shift toward networks of virtual private servers and compromised smart devices to conceal their campaigns, researchers with Google Cloud\u2019s Mandiant said Wednesday. <\/p>\n<p>Although not necessarily a new tactic, the growing use of such networks, akin to botnets, makes life harder for those tasked with defending networks amid <a href=\"https:\/\/cyberscoop.com\/tag\/volt-typhoon\/\">frequent warnings from Western governments<\/a> about aggressive Chinese espionage and <a href=\"https:\/\/cyberscoop.com\/feds-chinese-hacking-operations-have-been-in-critical-infrastructure-networks-for-five-years\/\">pre-positioning within U.S. critical infrastructure networks<\/a> as part of activity tracked as Volt Typhoon. <\/p>\n<p>The tactic also represents the latest way in which Chinese hacking operations are <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/chinese-espionage-tactics?e=48754805\">growing increasingly difficult to detect<\/a>. <\/p>\n<p>The obfuscation networks \u2014 known as \u201coperational relay box networks,\u201d or ORBs \u2014 are not operated directly by government-controlled hacking units, the researchers said. Instead, they\u2019re administered by contractors or other administrators within China and are frequently used by multiple Chinese government-linked hacking campaigns as part of espionage or reconnaissance efforts.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The approach dovetails with tactics used by many state-aligned actors \u2014 not just those from China \u2014 who <a href=\"https:\/\/arstechnica.com\/security\/2024\/02\/kremlin-backed-hackers-are-infecting-ubiquity-edgerouters-fbi-warns\/\">compromise small and home office routers<\/a> to route traffic through devices that are less likely to be secured and also can help obfuscate the traffic\u2019s origin. In January, for instance, the U.S. Department of Justice disrupted a network of hundreds of such routers being used by Russian military intelligence \u201cto conceal and otherwise enable a variety of crimes,\u201d the <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian\">agency said at the time<\/a>.<\/p>\n<p>ORB networks are composed of \u201cnodes,\u201d or individual physical or virtual devices, that are typically routers or leased virtual private servers, or both, the researchers said, with key relay nodes at a major Chinese or Hong Kong-based cloud provider. They\u2019re distributed across the world in a way that reduces exposure and limits any one country\u2019s ability to shut them down. <\/p>\n<p>An example ORB tracked by Mandiant as \u201cSpacehop,\u201d which the researchers said is used by multiple Chinese-linked hacking campaigns, \u201cmaintains a robust volume of nodes in Europe, the Middle East, and the United States,\u201d per the report. <\/p>\n<figure class=\"wp-block-image aligncenter\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say.png?w=640&ssl=1\" alt><figcaption class=\"wp-element-caption\">(Courtesy Mandiant)<\/figcaption><\/figure>\n<p>ORB network-hosted infrastructure, such as domains or IP addresses, have a short lifespan, meaning that traditional clues and indicators used by defenders to spot and remedy adversarial operations are increasingly less relevant, the researchers said. The indicators, known in the threat intelligence industry as \u201cIndicators of Compromise,\u201d or IOCs, have for years been relied upon to detect and block likely malign behavior, but the use of ORBs make IOCs a less reliable tool for detecting and blocking hacking operations. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Michael Raggi, principal analyst at Mandiant, said it used to be that a defender could block one known bad IP address targeting their network. \u201cNow you\u2019re protected against that one IP, but what if you also knew that this ORB network consisted of somewhere between 200,000- 300,000 IPs, and they cycle out those IP addresses between 60 and 90 days?\u201d Raggi said in an email. <\/p>\n<p>The use of such tactics by state-backed hacking groups represents a particularly difficult threat to defend against. \u201cYou\u2019re dealing with a dedicated entity whose sole job it is to maintain a vast array of different types of compromised routers, just for the purpose of renting those out so that someone can try and access your environment with them,\u201d Raggi said. <\/p>\n<p>The ORBs themselves should be tracked as their own distinct threats, the researchers said. <\/p>\n<p>\u201cRather than waiting to be reactive, or responsive to block each IP as an indicator of compromise, you should be trying to look at the patterns of infrastructure that they\u2019re registering, what types of routers they are compromising, what ports and services do we know that they\u2019re coming from,\u201d Raggi said. \u201cThis way you have a profile of activity to look for \u2014 something to create behavior-based rules with now, rather than just rely on indicators of compromise that you\u2019re blocking in one-off.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.1219008264463\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/china-hacking-operational-relay-box-networks\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Chinese-linked hacking units increasingly use \u2018ORBs\u2019 to obfuscate espionage, researchers<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2080,271,78,302,2081,1498],"tags":[2082,277,86,306,2083,1499],"class_list":["post-3691","post","type-post","status-publish","format-standard","hentry","category-botnets","category-china","category-cybersecurity","category-geopolitics","category-operational-relay-box-networks-orbs","category-volt-typhoon","tag-botnets","tag-china","tag-cybersecurity","tag-geopolitics","tag-operational-relay-box-networks-orbs","tag-volt-typhoon"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/botnets\/\" rel=\"category tag\">botnets<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/china\/\" rel=\"category tag\">China<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/operational-relay-box-networks-orbs\/\" rel=\"category tag\">operational relay box networks (ORBs)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/volt-typhoon\/\" rel=\"category tag\">Volt Typhoon<\/a>","tag_info":"Volt Typhoon","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=3691"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3691\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=3691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=3691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=3691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":3691,"date":"2024-05-22T09:00:00","date_gmt":"2024-05-22T14:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=80482"},"modified":"2024-05-22T09:00:00","modified_gmt":"2024-05-22T14:00:00","slug":"chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/05\/22\/chinese-linked-hacking-units-increasingly-use-orbs-to-obfuscate-espionage-researchers-say\/","title":{"rendered":"Chinese-linked hacking units increasingly use \u2018ORBs\u2019 to obfuscate espionage, researchers say"},"content":{"rendered":"