In the ever-evolving realm of cybersecurity, a new challenge has emerged: Onion Router Bot (ORB) proxy networks. These networks are being increasingly utilized by state-sponsored hackers to obfuscate the origin of their traffic and launch cyberattacks, making detection and attribution a significant challenge for enterprise defense systems.
Traversal nodes, the main nodes in an ORB network, and Exit/Staging nodes, used to launch attacks on targets, are key components of these networks. The victim server is the victim infrastructure communicating with the node on the ORB network.
The use of ORBs is not entirely new. A notable recent example is the Volt Typhoon attacks on US critical infrastructure organizations using Small Office/Home Office (SOHO) network equipment such as routers, firewalls, and VPN appliances.
What makes ORBs particularly challenging is their stealth, resilience, and independence from the internet infrastructure in a country. Multiple threat actors can use these network infrastructures for limited periods, which complicates tracking and attribution. According to cybersecurity firm Mandiant, the lifespan of an IPv4 address of an ORB node can be as short as 31 days, a feature often exploited by ORB network contractors in China.
Defenders can easily miss malicious traffic from these networks as ORB administrators use Autonomous System Number (ASN) providers in various parts of the world. This not only makes the networks more reliable but also allows adversaries to target enterprises from devices in close geographic proximity, raising fewer suspicions when analyzing traffic.
Mandiant illustrates this with an example, stating, "One such example would be traffic from a residential ISP that is in the same geographic location as the target that is regularly used by employees and would be less likely to get picked up for manual review."
As attackers increasingly turn to ORBs, protecting enterprise environments becomes even more difficult. Detection becomes more complex, attribution is more complicated, and indicators for adversary infrastructure are less useful for defenders. This rising threat of ORB proxy networks underscores the need for continuous innovation and vigilance in the field of cybersecurity.
