FLORAHOX Activity

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. FLORAHOX Activity is conducted using a hybrid operational relay box (ORB) network, which combines two types of infrastructure: compromised devices and leased Virtual Private Servers (VPS). The compromised devices include end-of-life routers and IoT devices, while VPS space is commercially leased and managed by ORB network administrators. This hybrid ORB network allows adversaries to proxy and obscure malicious traffic, making the source of the traffic more difficult to trace. The FLORAHOX ORB network has been leveraged by multiple cyber threat actors, including China-nexus actors like ZIRCONIUM. These adversaries conduct espionage campaigns through FLORAHOX Activity, relying on the ORB network's ability to funnel traffic through Tor nodes, provisioned VPS servers, and compromised routers to obfuscate malicious traffic.(Citation: ORB Mandiant)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2019-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-05-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1584.008 · Network Devices

  Resource Development — FLORAHOX Activity has compromised network routers and IoT devices for the ORB network.(Citation: ORB Mandiant)

• T1583.003 · Virtual Private Server

  Resource Development — FLORAHOX Activity has used acquired Virtual Private Servers as control systems for the ORB network.(Citation: ORB Mandiant)

• T1059.004 · Unix Shell

  Execution — FLORAHOX Activity has executed multiple Bash controller scripts to provide command line inputs for FLORAHOX traversal configurations.(Citation: ORB Mandiant)

• T1090.003 · Multi-hop Proxy

  Command And Control — FLORAHOX Activity has routed traffic through a customized Tor relay network layer.(Citation: ORB Mandiant)

• T1059 · Command and Scripting Interpreter

  Execution — FLORAHOX Activity has executed PHP and Shell scripts to identify and infect subsequent routers for the ORB network.(Citation: ORB Mandiant)

• T1190 · Exploit Public-Facing Application

  Initial Access — FLORAHOX Activity has exploited and infected vulnerable routers to recruit additional network devices into the ORB.(Citation: ORB Mandiant)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0053

  Official MITRE ATT&CK campaign record C0053. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.