ORB Networks Leverages Compromised IoT Devices and SOHO Routers to Mask Cyberattacks

**Executive summary:** The report describes ORB (Operational Relay Box) networks—mesh infrastructures of compromised routers, IoT devices, and VPS—used to anonymize and persistently route espionage traffic, linking observed activity to China‑nexus actor UNC3886 exploiting a zero‑day against Singapore telcos and leveraging custom backdoors and staging nodes to exfiltrate network‑related data.