< Back
Episode #
21

ORB Networks, Ceasefire Cyber Warfare, and AI Infrastructure Exploits

This week on Dragon News Bytes, senior threat intel advisor Eli Woodward is joined by colleagues Lucas and Stephen to dive into the changing mechanics of modern cyber espionage and nation-state warfare. From the tactical evolution of China-nexus operational relay box (ORB) networks to the strategic role of cyber operations during physical ceasefires, the team breaks down what defenders need to track right now.

Plus, we look ahead to Black Hat and DEF CON 2026, previewing groundbreaking research on Clop ransomware and AI infrastructure exploitation.

‍

Topics & References

‍

Part 1: The Summer Conference Circuit & Cutting-Edge Research

  • DEF CON 2026 Preview: Eli breaks down his four upcoming presentations covering the threat landscape.
  • Six Years of Clop Ransomware: A deep dive at Recon Village into Clop’s campaign history—unpacking nine major campaigns over six years, seven of which relied on zero-day exploits.
  • Exploiting the AI Layer: Previewing research from AI Village and Adversary Village on how threat actors are targeting LLM backend infrastructure, specifically utilizing heavy compute power to deploy coin miners.
  • Team Cymru User Group Meetup: Happening Thursday afternoon, August 6th, alongside Black Hat and the US Cyber Games. A practitioner-focused session to share new data tools, investigations, and advanced use cases.

Part 2: China-Nexus UAT 7810 & The Expansion of ORB Networks

  • The Lapdog Connection: Cisco Talos reports tracking UAT 7810, a China-nexus group leveraging the "Lapdog" Orb (Operational Relay Box) network.
  • New Malware Arsenal: The group is deploying specialized malware families, including Longleash, Dog Leash, and Jarleash, by exploiting edge router vulnerabilities.
  • The Death of Static IP IOCs: The team reflects on how compromised SOHO and enterprise routers are forming massive relay webs, making traditional IP-based indicators functionally obsolete.
  • Behavioral Fingerprinting: Why defenders must pivot from static blocking to behavioral analysis—monitoring anomalous router-to-router communications to identify state-sponsored proxy infrastructure.

Part 3: Cyber Domain Dynamics — Warfare During Ceasefires

  • The Israel-Iran Cyber Axis: Analyzing recent Iranian cyber assaults against Israel that surged precisely during a June kinetic ceasefire.
  • The Asymmetric Battlefield: How cyber operations serve as a continuous, low-cost mechanism for espionage and disruption when physical munitions pause.
  • The Interplay of Domains: A look at how cyber and kinetic actions complement each other, where cyber operations often ramp up to gather critical intelligence precisely when physical conflicts slow down.

Connect with Us

‍

Disclaimer: The views expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of our employers.

‍