ORB Networks Mask Cyberattacks Using Compromised IoT Devices and SOHO Routers

The report describes Operational Relay Box (ORB) networks — composed of compromised IoT devices, SOHO routers, and VPS — being used to hide attacker origin and blend malicious traffic with legitimate residential and business traffic. It highlights a February 2026 campaign attributed to state‑sponsored UNC3886 that exploited zero‑day perimeter firewall vulnerabilities and deployed advanced rootkits to maintain persistent access across Singapore’s four major telecommunications operators, noting ORB pre‑positioning tactics and recommending proactive threat hunting, behavioral analytics, Zero Trust models, regular router updates, and network monitoring.