![[DEEP RESEARCH] The bad IP was never the Actor.](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/size/w600/2026/06/zz-2.png)
deep
[DEEP RESEARCH] The bad IP was never the Actor.
A bad IP can be accurate and still tell the wrong story.
orb-networks
purplehaze
PurpleHaze’s Dynamic ORB Networks: Advanced Tactics, Detection Challenges, and Mitigation Strategies
PurpleHaze, an emerging Chinese state-sponsored threat group, operates highly dynamic multi-hop ORB networks that blend compromised IoT devices (notably SOHO routers with vulnerable firmware) and provisioned VPS to obscure command-and-control (C2) infrastructure.
orb-networks
RESEARCH: IoCs are dead. Long Live IoCs.
Orb networks, also known as Operational Relay Box (ORB) networks, are sophisticated proxy networks used by APT groups, particularly Chinese cyber-espionage actors, to obfuscate their activities and evade detection.