State hackers turn to massive ORB proxy networks to evade detection

Security researchers are warning that China-linked state-backed hackers are increasingly relying on a vast proxy server network created from virtual private servers and compromised online devices for cyberespionage operations.

Called operational relay box (ORBs) networks, these proxy meshes are administered by independent cybercriminals that provide access to multiple state-sponsored actors (APTs).

ORBs are similar to botnets but they may be a hybrid of commercially leased VPS services and compromised devices, including end-of-life routers and other IoT products.

The growing use of ORBs by adversaries comes with challenges in both detection and attribution as the attack infrastructure is no longer controlled by the threat actor, who can cycle through nodes distributed over a broad geography.

Malicious proxy networks

Cybersecurity firm Mandiant has been tracking multiple ORBs, two of them used by advanced threat actors known for espionage and intellectual theft operations linked to China.

One of them called ORB3/SPACEHOP is described as “a very active network leveraged by multiple China-nexus threat actors, including APT5 and APT15” for reconnaissance and vulnerability exploitation.

For instance, SPACEHOP was used in December 2022 to exploit CVE-2022-27518, a critical vulnerability in Citrix ADC and Gateway, which the National Security Agency (NSA) linked to APT5 (a.k.a. Manganese, Mulberry Typhoon, Bronze Fleetwood, Keyhole Panda, and UNC2630).

Mandiant researchers say that SPACEHOP is a provisioned network that uses a relay server hosted in Hong Kong or China by a cloud provider. It installs an open-source command and control (C2) framework that allows managing downstream nodes.

The relay nodes are typically cloned Linux-based images and their role is to proxy malicious traffic to an exit node that communicates with targeted victim environments.

By contrast, ORB2/FLORAHOX is a hybrid network that consists of an Adversary Controlled Operations Server (ACOS), compromised connected devices (routers and IoT), and VPS services that run the traffic through TOR and multiple hacked routers.

The researchers believe that this mesh is “used in cyber espionage campaigns by a diverse set of China-nexus threat actors” to obfuscate the traffic from the source.

The network appears to contain several subnetworks composed of compromised devices recruited by the router implant FLOWERWATER as well as other router-based payloads.

Although ORB2/FLORAHOX is used by multiple threat actors, Mandiant says that trusted third-party sources have reported clusters of activity attributed to China-linked adversaries APT31/Zirconium that focus on intellectual property theft.

“ORB2 represents a more complicated design including the relay of traffic through TOR nodes, provisioned VPS servers, and different types of compromised routers including CISCO, ASUS, and Draytek end-of-life devices” - Mandiant

Apart from FLOWERWATER, the researchers say that additional payloads and tools (MIPS router tunneler PETALTOWER, SHIMMERPICK bash scripts) are used to navigate the ORB2 network and pre-existing nodes based on command-line inputs.

Regardless of the type of devices used, an ORB network has a set of essential components that allow it to work properly:

Adversary Controlled Operations Server (ACOS) - server for administering nodes in an ORB network Relay node - lets users authenticate to the network and relay traffic through the larger traversal pool on ORB nodes Traversal nodes - the main nodes composing an ORB network, obfuscate the origin of the traffic Exit/Staging nodes - used to launch attacks on targets Victim server: victim infrastructure communicating with the node on the ORB network

Enterprise defense challenges

The use of ORBs has been observed in the past, the most prominent recent example being the Volt Typhoon attacks on US critical infrastructure organizations using SOHO network equipment (e.g. routers, firewalls, and VPN appliances).

Because of how malicious ORBs function, they provide stealth, resilience, and independence from the internet infrastructure in a country.

Multiple threat actors use these network infrastructures for limited periods, which impacts tracking them and attribution.

According to Mandiant, the lifespan of an IPv4 address of an ORB node can be as short as 31 days. This appears to be a feature of ORB network contractors in China, who can “cycle significant percentages of their compromised or leased infrastructure on a monthly basis.”

Defenders can miss malicious traffic from these networks because ORB administrators use Autonomous System Number (ASN) providers in various parts of the world.

Apart from making them more reliable, this also allows adversaries to target enterprises from devices in close geographic proximity, which raises less suspicions when analyzing traffic.

“One such example would be traffic from a residential ISP that is in the same geographic location as the target that is regularly used by employees and would be less likely to get picked up for manual review” - Mandiant

With attackers increasingly using ORBs, protecting enterprise environments becomes even more difficult since detection becomes more complex, attribution is more complicated, and indicators for adversary infrastructure are less useful for defenders.