* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Tuesday, July 8, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    MAY HER SOUL REST IN PEACE 🙏 Veteran entertainment columnist and talent manager Lolit Solis has passed away. She was 78 years old. https://tinyurl.com/6kumarkx | LatestChika.com – Facebook

    Beloved Entertainment Icon Lolit Solis Passes Away at 78 – A Life Remembered with Love and Respect 🙏

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    New Technology for Water Efficiency and Working with Mexico on Screwworm – AG INFORMATION NETWORK OF THE WEST

    Revolutionary Water Efficiency Technology and Cross-Border Collaboration to Defeat Screwworm

    Environmental cognitive distance, R&D capability distance, and supply chain green technology innovation – Nature

    Bridging Gaps: How Environmental and R&D Differences Drive Green Technology Innovation in Supply Chains

    LG Innotek CEO Moon Hyuksoo: “Our Next-gen Substrate Technology Will Change the Industry Paradigm” – TechPowerUp

    LG Innotek CEO Moon Hyuksoo: “Our Next-Gen Substrate Technology Will Revolutionize the Industry” Revolutionizing the Future: LG Innotek’s CEO Unveils Game-Changing Next-Gen Substrate Technology

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    MAY HER SOUL REST IN PEACE 🙏 Veteran entertainment columnist and talent manager Lolit Solis has passed away. She was 78 years old. https://tinyurl.com/6kumarkx | LatestChika.com – Facebook

    Beloved Entertainment Icon Lolit Solis Passes Away at 78 – A Life Remembered with Love and Respect 🙏

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    New Technology for Water Efficiency and Working with Mexico on Screwworm – AG INFORMATION NETWORK OF THE WEST

    Revolutionary Water Efficiency Technology and Cross-Border Collaboration to Defeat Screwworm

    Environmental cognitive distance, R&D capability distance, and supply chain green technology innovation – Nature

    Bridging Gaps: How Environmental and R&D Differences Drive Green Technology Innovation in Supply Chains

    LG Innotek CEO Moon Hyuksoo: “Our Next-gen Substrate Technology Will Change the Industry Paradigm” – TechPowerUp

    LG Innotek CEO Moon Hyuksoo: “Our Next-Gen Substrate Technology Will Revolutionize the Industry” Revolutionizing the Future: LG Innotek’s CEO Unveils Game-Changing Next-Gen Substrate Technology

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

ORBs: Hacking groups’ new favourite way of keeping their attacks hidden

May 22, 2024
in Technology
ORBs: Hacking groups’ new favourite way of keeping their attacks hidden
Share on FacebookShare on Twitter

Beware the ORB: why attacks on your network could come from a home router down the street


Steve  Ranger

By

Steve Ranger

Published: 22 May 2024 15:00

Cyber-espionage groups are making it harder to spot where their attacks are coming from by upping their usage of proxy networks – known as operational relay box networks or ORBs – that can throw defenders off the scent.

Cyber security company Mandiant has warned that it has seen a growing trend for China-backed espionage operations, in particular, to use ORBs to cover their tracks.

These ORB networks are somewhat like botnets and can be made up of virtual private servers (VPS), as well as compromised internet of things (IoT) devices and insecure routers. This combination makes it harder for defenders to track attacks because these groups can disguise traffic between their command-and-control infrastructure and their final targets.

ORB networks are one of the major innovations in Chinese cyber espionage that are challenging defenders, said Michael Raggi, Mandiant principal analyst at Google Cloud.

“They’re like a maze that is continually reconfiguring with the entrance and the exit disappearing from the maze every 60 to 90 days,” he said. “To target someone, these actors may be coming from a home router right down the street. It’s not unusual for an entirely unwitting person’s home router to be involved in an act of espionage.” 

These networks are often built by renting VPS and using malware designed to target routers to grow the number of devices capable of relaying traffic. Because the makeup of these networks changes rapidly, using an ORB network makes it harder to spot attacks and pin them on a particular group in terms of attribution.

That makes classic indicators of compromise (IOC) – the tech details and clues commonly shared about attacks – less useful because these groups will regularly cycle through network infrastructure.

The scale of these networks, Mandiant said, means attackers can piggyback on devices that have a handy geographic proximity to targeted enterprises. That allows their malicious traffic to blend in when being reviewed by analysts.

“One such example would be traffic from a residential ISP that is in the same geographic location as the target that is regularly used by employees and would be less likely to get picked up for manual review,” said Mandiant’s report.

As a result, the security company said, enterprise security teams should shift their thinking. That means that rather than treating ORB networks as just part of the infrastructure used by attackers, they should track ORBs “like evolving entities akin to APT [advanced persistent threat] groups”.

ORB networks are not a new invention and have regularly been used as part of espionage campaigns to obscure who the attacker is and where they are. But Mandiant said the use of these networks by China-backed espionage actors has become more common over recent years.

These ORBs are infrastructure networks run by contractors or others within China. They are not controlled by a single APT espionage or hacking group, but are shared between them, which Mandiant said means multiple APT actors will use the ORB networks to carry out their own distinct espionage and reconnaissance.

This infrastructure often shifts – the lifespan of an IPv4 address associated with an ORB node can be as short as 31 days. Mandiant said a competitive differentiator among ORB network contractors in China appears to be their ability to cycle significant percentages of their compromised or leased infrastructure on a monthly basis.

That means just blocking the infrastructure linked to an ORB network at a particular time is not going to be as effective as was previously the case. “As a result, IOC extinction is accelerating and the shelf life of network indicators is decreasing,” Mandiant said.

“Infrastructure or the compromised router device communicating with a victim environment may now be identifiable to a particular ORB network, while the actor using that ORB network to carry out the attack may be unclear and require investigation of the complex tools and tactics observed as part of an intrusion,” the report said.

John Hultquist, Mandiant chief analyst, Google Cloud, added: “Chinese cyber espionage was once noisy and easily trackable. This is a new type of adversary.”

The nodes in an ORB network are usually distributed globally. Mandiant gives the example of one it tracks as ORB3 or Spacehop, which it described as a very active network used by multiple China-backed groups.

It uses a relay server hosted in either Hong Kong or China by cloud providers, while the relay nodes are often cloned Linux-based images, which are used to proxy malicious network traffic through the network to an exit node that communicates with targeted victim environments.

Mandiant said it was notable that this network has a “robust volume” of nodes in Europe, the Middle East, and the US – all of which are regions targeted by China-backed APT15 and ATP5.

In contrast, another network that Mandiant tracks (known as ORB2 or Florahox) also features compromised network routers and IOT devices. The network appears to contain several subnetworks composed of compromised devices recruited by the router implant known as Flowerwater.

Mandiant said that all of this creates a problem for defenders, because rather than simply blocking infrastructure associated with attackers they now have to consider what infrastructure is part of the ORB network right now, for how long, and who is using the ORB network.

Mandiant added that the best way to deal with the challenge posed by ORB networks is to stop tracking espionage command and control infrastructure as an inert indicator of compromise and start tracking it as an entity in itself.

“Instead, infrastructure is a living artifact of an ORB network that is a distinct and evolving entity where the characteristics of IP infrastructure itself, including ports, services, and registration/hosting data, can be tracked as evolving behaviour by the adversary administrator responsible for that ORB network,” Mandiant said.

It warned that the rise of the ORB industry in China points to long-term investments in equipping China-backed cyber operations with more sophisticated tactics and tools.

“Whether defenders will rise to this challenge depends on enterprises applying the same deep tactical focus to tracking ORB networks as has been done for APTs over the past 15 years,” Mandiant said.

Read more on Hackers and cybercrime prevention


Fancy Bear sniffs out Ubiquiti router users

AlexScroxton

By: Alex Scroxton


Critical infrastructure hacks raise alarms on Chinese threats

AlexanderCulafi

By: Alexander Culafi


US government disrupts Chinese botnet containing hundreds of end-of-life Cisco and Netgear routers

CarolineDonnelly

By: Caroline Donnelly


Chinese threat group exploited VMware vulnerability in 2021

ArielleWaldman

By: Arielle Waldman

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Computer Weekly – https://www.computerweekly.com/news/366585945/ORBs-Hacking-groups-new-favourite-way-of-keeping-their-attacks-hidden

Tags: Group’sHackingtechnology
Previous Post

AI Seoul Summit: 27 nations and EU to set red lines on AI risk

Next Post

Dutch employers should discuss using algorithms in managing staff

An episodic burst of massive genomic rearrangements and the origin of non-marine annelids – Nature

Explosive Genomic Shifts Ignite the Evolutionary Rise of Land-Dwelling Annelids

July 8, 2025
Earth is going to spin much faster over the next few months — so fast that several days are going to get shorter – Live Science

Earth is going to spin much faster over the next few months — so fast that several days are going to get shorter – Live Science

July 8, 2025
Putnam Museum and Science Center Ribbon-Cutting July 12 – River Cities’ Reader

Putnam Museum and Science Center Ribbon-Cutting July 12 – River Cities’ Reader

July 8, 2025
New Miiro Lifestyle Hotel Brand Expands Further In Europe – Forbes

New Miiro Lifestyle Hotel Brand Expands Further In Europe – Forbes

July 8, 2025
Dino Might!: ‘Jurassic World Rebirth’ Bows To $318.3M Global In Biggest Studio Opening Year-To-Date WW; ‘F1’ Nears $300M’ & ‘Dragon’ Tops $500M – International Box Office – Deadline

Dino Might!: ‘Jurassic World Rebirth’ Bows To $318.3M Global In Biggest Studio Opening Year-To-Date WW; ‘F1’ Nears $300M’ & ‘Dragon’ Tops $500M – International Box Office – Deadline

July 8, 2025
As a Nation’s Economy Slows, Some Say It’s No Time for a Free Lunch – The New York Times

As a Nation’s Economy Slows, Some Say It’s No Time for a Free Lunch – The New York Times

July 8, 2025
Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

July 8, 2025
The 63 Best Amazon Prime Day Health & Fitness Deals, Up to 85% Off – health.com

The 63 Best Amazon Prime Day Health & Fitness Deals, Up to 85% Off – health.com

July 8, 2025
Scoop: Sean Patrick Maloney mulls political comeback against Mike Lawler – Axios

Sean Patrick Maloney Eyes Bold Political Comeback, Taking on Mike Lawler

July 8, 2025

Lake Land College to host grand opening celebration for Effingham Technology Center – wandtv.com

July 7, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (710)
  • Economy (735)
  • Entertainment (21,623)
  • General (15,771)
  • Health (9,773)
  • Lifestyle (740)
  • News (22,149)
  • People (735)
  • Politics (744)
  • Science (15,952)
  • Sports (21,233)
  • Technology (15,718)
  • World (716)

Recent News

An episodic burst of massive genomic rearrangements and the origin of non-marine annelids – Nature

Explosive Genomic Shifts Ignite the Evolutionary Rise of Land-Dwelling Annelids

July 8, 2025
Earth is going to spin much faster over the next few months — so fast that several days are going to get shorter – Live Science

Earth is going to spin much faster over the next few months — so fast that several days are going to get shorter – Live Science

July 8, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version