# What is an ORB network? Operational relay box networks explained > How operational relay box (ORB) networks, or covert networks of compromised devices, hide state-sponsored traffic, why blocklists fail and how to respond. --- LLMS index: [llms.txt](/llms.txt) --- **In short:** an operational relay box (ORB) network is a mesh of compromised devices, and often rented servers, that threat actors use to relay their traffic so it arrives from an ordinary-looking address near the target rather than from its true origin. Governments call them covert networks of compromised devices. Their nodes change constantly, so blocklists of their addresses go stale almost as fast as they are written. ## What is an ORB network? The term *operational relay box* comes from threat intelligence reporting on state-sponsored espionage. An ORB network is relay infrastructure: hundreds or hundreds of thousands of nodes that an operator can route traffic through, picking an exit that suits the target. In April 2026 a joint advisory led by the UK's National Cyber Security Centre, with partners including CISA, the FBI, the NSA and agencies in Germany, the Netherlands, Spain and Sweden, described the same infrastructure as *covert networks of compromised devices*: a way to connect across the internet in a low-cost, low-risk, deniable way. The advisory notes they are also known as botnets. ## How does an ORB network work? A connection through a covert network typically passes through three kinds of node: 1. **On-ramp, or entry node.** Where the operator connects, often a rented virtual private server. 2. **Traversal nodes.** Compromised devices that forward the traffic onwards, so no single hop reveals both ends. 3. **Exit node.** The device the target sees, usually in the same geographic region as the target, so the connection looks local and unremarkable. The operator can change the path, the exit or the whole network at will, and several groups can draw on the same infrastructure. ## What devices make up ORB networks? Mostly devices that are always on, rarely monitored and often no longer updated: - small office and home office (SOHO) routers; - Internet of Things and smart devices, including web cameras and video recorders; - firewalls and network-attached storage (NAS) devices; - end-of-life equipment that no longer receives security patches. Researchers distinguish networks built from rented servers (provisioned), networks built from compromised devices, and hybrids of the two. The compromised kind is harder to counter, because its exit addresses belong to real homes and businesses. ## Why do threat actors use ORB networks? - **Deniability.** Traffic arrives from a stranger's router, not from infrastructure tied to the operator. - **Blending in.** An exit near the target, on a residential or business connection, looks like ordinary local traffic. - **Low cost and low risk.** Vulnerable devices are plentiful, and losing a node costs little. - **Resilience.** When a node is patched or taken down, another replaces it. ## ORB network vs botnet, residential proxy, Tor and VPN | | Who runs it | What it is made of | Who uses it | Exits look like | |---|---|---|---|---| | **ORB network** | A threat actor, or a company working for one | Compromised devices, often with rented servers as on-ramps | Espionage and intrusion operators, sometimes several groups | Home and business connections near the target | | **Botnet** | A criminal or state operator | Compromised devices | Anything from denial of service and spam to relaying | Home and business connections | | **Residential proxy network** | A commercial provider | Devices enrolled through apps and SDKs, sometimes through malware | Anyone who pays, attackers included | Home connections, anywhere the provider has them | | **Tor** | Volunteers | Public relays | Anyone | Published exit relays | | **Commercial VPN** | A commercial provider | The provider's servers, usually in datacentres | Anyone who subscribes | The provider's datacentre ranges | The categories overlap. Covert networks are a kind of botnet, residential proxy networks are sometimes built on infected devices, and threat actors use all of them. What sets ORB networks apart is purpose: they exist to carry an operator's traffic quietly to targets. ## What is IOC extinction? Indicators of compromise (IOCs) such as IP addresses are only useful while they stay valid. Covert networks wear them out. Because a single group can operate from many networks, each with potentially hundreds of thousands of endpoints, and because new nodes are added as old devices are patched or removed, an address seen in one intrusion is unlikely to be seen in the next. The advisory concludes that static malicious IP blocklists will be less effective. ## Examples of covert networks The April 2026 advisory names two: - **Raptor Train**, which in 2024 infected more than 200,000 devices worldwide. The advisory says it was controlled and managed by Integrity Technology Group, a Chinese company the FBI assessed was responsible for intrusions attributed to the actor known as Flax Typhoon. - **KV Botnet**, used by the actor known as Volt Typhoon and made up mainly of vulnerable, end-of-life small-office routers. ## How can defenders respond? The advisory's recommendations include: - **Use dynamic threat feeds that include covert network infrastructure**, and for the largest or most at-risk organisations, dynamic blocklists built from threat reporting. - **Look upstream.** Use flow data to map covert networks and find new nodes, rather than waiting for them to appear in your own logs. Webscout's [Covert network flows](/solutions/intelligence/covert-network-flows/) provides flows from inside those networks for this work. - **Track covert networks as threats in their own right**, alongside the actors that use them. [Bespoke collection / RFI](/solutions/intelligence/rfi/) enumerates a named network's addresses, nodes and relays, and monitors when they appear, move and go dark. - **Baseline normal connections**, so connections from unusual places stand out. In the [Webscout Observability Platform](/solutions/platform/), aggregations such as top values, unique counts and significant terms show what normal looks like in your connection logs, and live dashboards keep it in view. - **Harden remote access:** multi-factor authentication, and allow lists rather than deny lists for VPN access. - **Track networks by what persists**, such as banners and certificates, rather than by addresses alone. [JA4DB](/solutions/platform/ja4db/) returns the context behind any JA4+ fingerprint, including JA4X fingerprints of certificates. Fingerprints serve this purpose well: an address changes with every hop, while the software and configuration behind a connection change far less often. See [JA4+ fingerprints explained](/guides/ja4-fingerprints-explained/). Read the advisory itself on the [CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-113a) and [NCSC](https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices) websites. ## Where Webscout fits [Covert network flows](/solutions/intelligence/covert-network-flows/) gives vetted government partners visibility into the traffic that passes through covert networks, from Webscout's own collection inside Tor, residential proxy networks, botnets and ORB networks: more than 1.5 billion events a day, with JA4+ fingerprints and IP context on every connection, so an investigation can follow activity when addresses change. Search the flows for your own address ranges to see who reaches them through covert networks, including activity that never shows up in your own perimeter logs. Flows are delivered in the [Webscout Observability Platform](/solutions/platform/), or via S3 for on-premises ingestion. Where a specific network matters to a mission, [Bespoke collection / RFI](/solutions/intelligence/rfi/) builds visibility into it on request. The [Anonymising IPs](/solutions/datasets/vpn-proxy-detection/) dataset names the provider behind VPN and proxy exits, residential proxies included, and identifies every public Tor relay.