FLORAHOX Activity has executed PHP and Shell scripts to identify and infect subsequent routers for the ORB network.2
campaign
FLORAHOX Activity C0053
- First seen
- January 2019
- Last seen
- May 2024
- Created
- 25 March 2025
- Last modified
- 31 July 2026
FLORAHOX Activity is conducted using a hybrid operational relay box (ORB) network, which combines two types of infrastructure: compromised devices and leased Virtual Private Servers (VPS). The compromised devices include end-of-life routers and IoT devices, while VPS space is commercially leased and managed by ORB network administrators. This hybrid ORB network allows adversaries to proxy and obscure malicious traffic, making the source of the traffic more difficult to trace.
The FLORAHOX ORB network has been leveraged by multiple cyber threat actors, including China-nexus actors like ZIRCONIUM. These adversaries conduct espionage campaigns through FLORAHOX Activity, relying on the ORB network's ability to funnel traffic through Tor nodes, provisioned VPS servers, and compromised routers to obfuscate malicious traffic.[1]
6
TechniquesBottom 13%
4
TacticsBottom 16%
1
Tool or malware45th pct
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0053
FLORAHOX Activity has executed multiple Bash controller scripts to provide command line inputs for FLORAHOX traversal configurations.3
FLORAHOX Activity has routed traffic through a customized Tor relay network layer.4
FLORAHOX Activity has exploited and infected vulnerable routers to recruit additional network devices into the ORB.5
FLORAHOX Activity has used acquired Virtual Private Servers as control systems for the ORB network.6
FLORAHOX Activity has compromised network routers and IoT devices for the ORB network.7
Standing C0053
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques6Bottom 13%
13th percentile · 87% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics4Bottom 16%
16th percentile · 84% of 56 ATT&CK campaigns have more tactics spanned.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique18med61st pct
61st percentile · 61% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique0.5med
Detection coverage C0053
424 distinct rules cover the 6 techniques recorded for this campaign. The 443 technique-to-rule mappings resolve to 424 distinct rules, because one rule can cover several techniques. 264 Sigma · 160 Splunk.
4 covered by at least one rule2 with no coverage424 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org