Michael Raggi, Principal Analyst at Mandiant Intelligence, discusses ORB networks used by China-nexus threat actors for cyber espionage. Topics include the anatomy of ORB networks, how they are leveraged by APTs like SPACEHOP, and the implications for defenders. The conversation dives into the evolution of tactics, understanding and communication frameworks, and the challenges of attribution in cyber operations.
China Nexus adversaries utilize orb networks to obscure traffic in cyber espionage activities.
Mandiant Intel advocates for frameworks to define orb networks, aiding in attribution amidst complexity.
Deep dives
Evolution of Orb Networks in China Nexus Cyber Espionage
In the podcast, the evolution of orb networks in China Nexus cyber espionage activities is highlighted as a significant shift in the landscape of cyber threats. Orb networks, defined as operational relay box networks, are mesh networks utilized by cyber espionage adversaries to obfuscate their traffic. Unique to China Nexus activities, orb networks are created by private sector entities in China, enabling the use of pseudo botnets by multiple APT actors. This development indicates a rise in a private industry facilitating evasion at scale since 2016, showcasing an upleveling of capability and sophistication.
Types and Framework of Orb Networks
Existing primarily in two types, provisioned and non-provisioned, orb networks consist of leased VPS devices or compromised routers and IoT devices. Mandiant Intel identifies the need for defining orb networks to propose frameworks similar to MITRE ATT&CK for better understanding and tracking. The five-stage anatomy defined for orb networks includes stages like adversary controlled operation server, relay nodes, traversal nodes, and exit nodes, offering a universal approach to comprehensively describe orb networks' components.
Challenges in Attribution and Detection of Orb Networks
Attribution challenges arise with the complexity and ephemerality of orb networks. The adaptability of actors utilizing orb networks complicates target-centric intelligence practices, leading to a shift in how infrastructure is attributed and an increased emphasis on non-target collection. Enterprises are advised to focus on detecting malicious activity originating from compromised residential routers and devices communicating over unusual high-numbered ports, indicative of orb network activities. Looking ahead, continued vigilance and awareness are key as China Nexus actors increasingly leverage orb networks for cyber espionage.
Michael Raggi (Principal Analyst, Mandiant Intelligence) joins host Luke McNamara to discuss Mandiant's research into China-nexus threat actors using proxy networks known as “ORBs” (operational relay box networks). Michael discusses the anatomy and framework Mandiant developed to map out these proxy networks, how ORB networks like SPACEHOP are leveraged by China-nexus APTs, and what this all means for defenders.
For more, check out: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks
Follow Michael on X at @aRtAGGI
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode