Inside Look at a Chinese Operational Relay Network
Provides an inside look at a massive operational relay network (ORB) of compromised IoT devices and routers used by Chinese APT actors to obfuscate cyber attacks.
Summary
The Proliferation of Operational Relay Networks (ORBs)
State-sponsored threat actors increasingly abandon fixed commercial VPNs in favor of dynamic Operational Relay Networks (ORBs) constructed from thousands of compromised small office/home office (SOHO) routers and IoT devices.
Architecture and Node Management
Michael Torres and Zane Hoffman analyze the technical architecture of a prominent Chinese APT relay network, detailing how compromised devices are chained together via custom proxy daemons to route operational traffic.
Tracking and Mapping Nation-State Traffic
By analyzing routing behaviors, node churn rates, and communication protocols, threat intelligence researchers successfully mapped the proxy mesh back to state-sponsored offensive campaigns.
Disrupting and Mitigating ORB Infrastructure
Mitigating the threat of operational relay networks requires global cooperation among router manufacturers, ISPs, and law enforcement to remediate edge device vulnerabilities and conduct coordinated infrastructure takedowns.
Related talks
Main Stage·35 min
Andrew Brandt
Sophos researcher Andrew Brandt chronicles a five-year investigation into Chinese nation-state campaigns weaponizing zero-days against perimeter firewall appliances.
Adversary Village·45 min
Cheryl Biswas
Cheryl Biswas analyzes decades of Chinese state-sponsored supply chain intrusions and economic espionage campaigns across global technology sectors.
Main Stage·33 min
Ben Folland
Demonstrates methodologies for intercepting and decrypting command-and-control traffic between active malware implants and adversary servers.