IPA Warns VPN Flaws Fuel ORB Botnets

Japan's IPA warns that unpatched VPN appliances are being breached and turned into ORB relay nodes for further attacks.

The Information-technology Promotion Agency (IPA) of Japan has issued an advisory highlighting a wave of critical vulnerabilities in perimeter VPN appliances that are being actively exploited in network-penetrating attacks. Beyond initial intrusion into victim networks, IPA warns that compromised devices are increasingly being converted into Operational Relay Boxes (ORBs) — hijacked infrastructure used as staging points to launch attacks against third-party organizations, with some ORB nodes reportedly folded into larger botnet operations.

The advisory does not name specific CVEs or vendors in the released text, but frames this as an ongoing, sector-agnostic risk: compromised VPN gear can be used for data theft, as a springboard for lateral attacks on other organizations, or retained as a persistent foothold for future intrusions — a concern echoed by Western government advisories warning of escalated exploitation during periods of geopolitical crisis. IPA recommends prompt patching, retiring end-of-life devices, disabling exposure of management interfaces, deploying Attack Surface Management (ASM) to track internet-facing assets, and reinforcing network segmentation with firewalls and IDS/IPS.

This is a general risk advisory rather than a report on a specific campaign or malware family, and it urges organizations to report anomalous device activity to IPA to support broader situational awareness of ORB-based attack infrastructure.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251031_vpn.html