ORB Networks Mask Cyberattacks Using Compromised IoT Devices and SOHO Routers

Operational Relay Box networks have emerged as one of the most sophisticated tools used by threat actors to hide their cyberattacks from security teams worldwide.

These obfuscated mesh networks consist of compromised Internet-of-Things devices, Small Office/Home Office routers, and Virtual Private Servers that work together to mask the true origin of malicious activities.

By routing attack traffic through multiple relay points, ORB networks make it extremely difficult for defenders to trace malicious activity back to its source, creating a significant challenge for cybersecurity professionals.

The threat became strikingly apparent when Singapore’s Cyber Security Agency revealed in February 2026 that the state-sponsored group UNC3886 had launched a targeted campaign against all four major telecommunications operators in the country: M1, SIMBA Telecom, Singtel, and StarHub.

The attackers exploited zero-day vulnerabilities in perimeter firewalls and deployed advanced rootkits to evade detection systems while maintaining persistent access to critical infrastructure.

Team Cymru researchers identified that these ORB networks provide attackers with several strategic advantages that traditional methods cannot match.

The networks act like private residential proxy services, allowing malicious traffic to blend seamlessly with legitimate user activity from home and business broadband connections.

This makes blocking efforts particularly risky, as defenders might inadvertently disrupt genuine services while attempting to stop attacks.

Attack Infrastructure and Pre-Positioning Tactics

The resilience of ORB networks stems from their distributed architecture and dynamic composition. Attackers can rapidly scale these networks by adding or removing compromised devices, making them highly resistant to takedown attempts.

When security teams discover and block one node, threat actors simply replace it with another, ensuring continuity of their operations without significant disruption.

What makes ORB networks particularly dangerous is their use for pre-positioning months before actual attacks occur.

Adversaries establish these relay infrastructures early, allowing them to conduct reconnaissance and probe target perimeters while maintaining operational security.

By routing traffic through nodes geographically close to their targets, attackers circumvent geofencing controls and make their activities appear more legitimate to security monitoring systems.

Security experts recommend that organizations implement proactive threat hunting strategies, behavioral analytics, and Zero Trust security models to defend against these sophisticated networks.

Regular router updates, network traffic monitoring, and integration of advanced threat intelligence remain essential protective measures.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.