Project ORBITAL Maps ORB Networks Used by China-Linked Threat Actors

Project ORBITAL, a new open-source intelligence initiative, has been launched to track and analyze Operational Relay Box (ORB) networks that advanced persistent threat actors use to hide command-and-control activity behind layers of compromised end-of-life SOHO routers and IoT devices. The project aggregates public reporting and telemetry from security vendors and U.S. government agencies into a centralized intelligence matrix and graph view, reflecting growing industry focus on ORB infrastructure as a durable method for obscuring attacker origin and blending malicious traffic with legitimate regional traffic.

The reporting says ASUS devices appear most frequently in public ORB disclosures, while the LapDogs ORB network has the highest number of reported targeted devices. It also identifies overlap in ORB usage among China-linked actors including APT15, UNC2630, and UNC5174, indicating some infrastructure may be provisioned by specialized teams and then shared or leased across a broader Chinese espionage ecosystem. The findings reinforce that ORB networks are no longer a niche tradecraft element but a standard operational security layer for multiple Chinese-linked intrusion sets.