Chinese Hackers Use RedRelay Multi-Hop Network to Conceal Global Cyber Operations

Chinese state-linked hackers are increasingly relying on a covert multi-hop infrastructure dubbed RedRelay (also known as ORBWEAVER) to mask the origins of global cyber operations, with evidence pointing to little-known Guangdong Chanming as a key enabler behind the network.

Guangdong Chanming, a low‑visibility company with no public‑facing products or marketing, has quietly amassed a portfolio of patents and software copyrights that point squarely to offensive network operations rather than commercial security tools.

Registrations reveal systems for “Internet Security Access,” “Multi‑functional Security Proxy,” “File Transfer Network,” “Anti‑traceability Network,” “Network Vulnerability Testing,” “Android Secret Extraction,” and “Telegram Data Collection,” terminology that is far more aligned with covert access and data exfiltration than with consumer cybersecurity.

Open‑source tracking shows that, instead of advertising to enterprises, Guangdong Chanming appears in People’s Liberation Army (PLA) procurement records as a supplier of anonymized network systems, suggesting its real customer base sits inside China’s defense and security establishment.

At the center of this infrastructure is a tunneling tool lineage that starts with FCN (Free Connect), an ostensibly benign VPN‑style utility authored under the developer identity “boywhp.”

Historical GitHub traces link “boywhp” to the domain xfconnect.com and to FCN binaries archived on malware repositories, some of which share strong code‑level and string overlaps with an executable named stn.exe, labeled “STN Security Tunnel.”

Dynamic and static analysis of stn.exe reveals explicit references to FCN, tying the open‑source tunneler directly to Guangdong Chanming’s STN product line and blurring any distinction between privacy tooling and operational tradecraft.

The technical pattern is consistent with China‑nexus cyber tooling more broadly, where nominal VPNs or “secure access” platforms double as infrastructure layers for state‑sponsored intrusion campaigns.

A distinctive Linux command used by FCN to enumerate network interfaces parsing /proc/net/route via chained awk filters has become a useful fingerprint for tracking its code across other malware families.

RedRelay Multi-Hop Network

A payload known as bulbature, better known in operations as WHIPWEAVE, which functions as a tunneling component within the RedRelay/ORBWEAVER multi‑hop proxy network, WordPress said.

Independent research from Mandiant and other vendors describes ORB networks as scalable meshes of compromised routers, IoT devices, and leased VPS nodes, contracted out as infrastructure‑as‑a‑service to multiple Chinese APTs to frustrate attribution and IOC‑based blocking.

Two of Guangdong Chanming’s patents reportedly describe anonymizing, multi‑hop traffic flows that align closely with RedRelay’s behavior, reinforcing the link between FCN/STN tooling and the ORBWEAVER ecosystem.

Procurement listings from PLA channels reference Guangdong Chanming delivering an “Anonymous Network System” to a unit based in Beijing’s Haidian District, a locality associated with the PLA Cyberspace Force.

Open‑source analysis further connects RedRelay usage to long‑tracked China‑nexus espionage groups clustered under labels such as APT15, Ke3chang, Vixen Panda, Red Vulture, and Nylon Typhoon, now additionally correlated with internal designations Unit 61046 and CSF 8th Bureau.

These operators have been observed conducting global intrusion campaigns against government, defense, and telecom targets, leveraging RedRelay’s multi‑hop relays to route command‑and‑control traffic through disposable nodes that sit well outside China’s borders.

In effect, Guangdong Chanming’s “ghost” infrastructure has become a critical layer in China’s cyber industrial complex, offering anonymized operational pathways to military and intelligence units while remaining almost invisible to the public internet.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist