FBI Takes Action Against Proxy Network Supporting Chinese Espionage

The FBI has taken significant action to disrupt a proxy network that was integral to Chinese cyber espionage activities. This network, referred to as a technical 'quartermaster,' was responsible for providing reconnaissance, proxy management, and operational routing capabilities that enabled espionage against U.S. entities.

Black Lotus Labs, the threat research division of Lumen Technologies, has been monitoring this infrastructure for over a year. Their research revealed that the network was used to profile and extract sensitive data from a wide range of targets, including U.S. military and defense organizations, government networks, universities, healthcare institutions, financial firms, and critical infrastructure sectors.

In a statement, Lumen Technologies commended the FBI and the Department of Justice for their efforts to combat Chinese cyber threats targeting U.S. critical infrastructure. During their investigation, Black Lotus Labs provided threat intelligence to various U.S. government agencies, alerting them to emerging risks that could jeopardize national security.

The researchers reported that they successfully disrupted the proxy network by null-routing traffic to known infrastructure points utilized by the operators of the quartermaster. This disruption is crucial as it targets the industrialized creation of Operational Relay Box (ORB) networks used by espionage operators linked to China.

These ORBs consist of decentralized networks made up of compromised devices, including routers, IoT devices, and commercial proxy nodes, which are employed to relay malicious traffic while obscuring its origin. The use of ORBs in cyber operations has increased significantly since 2024, with a notable uptick in activity earlier this year.

Instead of constructing a conventional ORB network from numerous compromised devices, the quartermaster purchased premium access to specific nodes operated by the Chinese commercial proxy service fastlink.ws. This arrangement led to the formation of Fast Labyrinth, an ORB-style relay network that integrated espionage traffic with legitimate consumer proxy traffic, automatically rotating its egress infrastructure to evade detection.

The overlap between the targets identified by QScan and organizations later contacted through Fast Labyrinth provides compelling evidence linking reconnaissance efforts to subsequent operations. Lumen Technologies assesses that the observed bidirectional connections from the proxy network likely indicate attempts at exploitation, lateral movement, persistent access, or data collection.

While the disruption of this provider marks a significant achievement, Lumen warns that simply blocking traffic may not suffice due to the dynamic nature of the quartermaster's operations, which utilize rotating commercial proxy services. Cyber defenders are advised to adhere to guidance from CISA and NCSC to mitigate threats associated with Chinese espionage and to ensure that routers, firewalls, and IoT devices are updated and securely configured.

The Blue Report 2026 highlights that overall prevention measures can obscure what occurs after initial access, as the effectiveness of prevention diminishes sharply once attackers gain valid credentials.