Global botnets are being abused by hackers – and they can even hide all the evidence using ORB networks

Threat actors are constantly evolving their techniques to remain undetected when infiltrating organizations, with new research revealing how persistent groups like Volt Typhoon are evading detection. Mandiant has observed increased usage of operational relay box networks (ORBs) to obscure indicators of compromise (IoC). These ORBs are essentially a botnet made of IoT devices, virtual private servers, smart devices, and older routers that no longer receive security updates. This complex mesh of devices helps to hide the activity of threat actors, with Mandiant assessing with moderate confidence that this technique is being used to push back against defenders by hiding their…