ColCERT Warns on ORB3 CHARLIE Network

Operation Timeline

Attack Chain and TTPs

The technical sequence described by ColCERT starts with an initial compromise of Internet-exposed servers. That matters because it points to more than isolated opportunistic intrusions, it marks the first step in a wider access chain. The alert maps that opening move to T1190, Exploit Public-Facing Application, which MITRE ATT&CK uses for the exploitation of exposed applications or services. In practice, the alert does not list a specific vulnerability for each case, but it does establish the pattern: actors begin with public-facing surfaces and then use ORB3 infrastructure to deepen access.

From there, the operation moves into mass scanning and brute-force attacks against SSH, PostgreSQL, and Apache Tomcat. ColCERT attributes that behavior to BruteEntry, a Go-based tool. The ATT&CK view that goes with this phase relies on T1046, Network Service Scanning, and T1110, Brute Force. The first covers active reconnaissance of network services. The second covers repeated, high-volume authentication attempts. Chaining those techniques explains why the alert focuses on privileged accounts, administrative access, and exposed services as the highest-risk points.

BruteEntry's operating model is especially clear. It is not just trying credentials. According to ColCERT, the tool scans services at scale, identifies valid credentials or vulnerable services, and automatically reports the finding in JSON to command-and-control infrastructure. That detail matters because it connects automated reconnaissance with the exploitation cycle. The JSON message is not decorative, it is the mechanism that centralizes results, coordinates the next action, and keeps the intrusion plane unified.

ColCERT also places the ORB3 network as the channel for that command-and-control traffic. The alert describes it as a multi-hop proxy that hides the true source of access, brute-force activity, and C2. MITRE ATT&CK covers that with T1071, Application Layer Protocol, since control communications can blend into application-layer protocols such as HTTP or HTTPS. The alert also mentions generic, reused, and long-lived SSL or TLS certificates, which further strengthens that camouflage layer.

On the host side, ColCERT cites wsprint.exe loading unsigned DLLs from C:\ProgramData\ as a possible compromise indicator. That fits T1036, Masquerading, because the use of plausible names for processes or files helps them blend in with legitimate components. MITRE defines that technique as the use of names or locations that imitate real system elements. The value of that finding in the alert is twofold. It creates a hunting pattern for Windows endpoints, and it provides a correlation signal with the rest of the chain, especially if the host also shows outbound connections to ORB3 nodes or unusual credential activity.

The operation does not rely on a single vector or one malware family. ColCERT adds exclusive backdoors, TernDoor for Windows and PeerTime for Linux or IoT ELF. That coexistence suggests a toolkit built to persist across heterogeneous telecom and critical-infrastructure environments. The presence of both implants, together with BruteEntry, points to a fairly clear functional split: access and reconnaissance on one side, persistence and control on the other.

Regional Impact

The alert is regional by design and by evidence. ColCERT does not limit it to one country, but places it across a South American corridor of telecom and critical-infrastructure targets. The strongest material scope is in Colombia, Chile, Peru, Argentina, Brazil, and Venezuela. According to the document, the campaign has been prioritized since 2024 and centers on telecom operators, communications providers, and OT environments that are exposed or poorly segmented.

Regional Picture

The regional pattern combines three elements. First, an initial compromise vector against exposed servers. Second, an exploitation and brute-force layer powered by BruteEntry automation. Third, a multi-hop ORB network that hides traffic origin and centralizes results. That combination makes the problem look more like a systematic access-preparation campaign than a series of isolated intrusions. In telecommunications, that can translate into access to management consoles, reused credentials, lateral movement into monitoring environments, and observation of network metadata or critical communications routes.

ColCERT also expands the risk to national critical infrastructure sectors. Energy, water systems, and transportation are identified as possible targets whenever their OT networks are exposed or too weakly segmented. The operational implication is direct. A poorly isolated OT network, with weak administrative access and administration surfaces visible from the Internet or from overly broad segments, can become an expansion point for actors already operating with reconnaissance, access, and persistence capabilities.

The actor profile outlined by ColCERT is one of state-oriented cyberespionage focused on military, diplomatic, and telecommunications intelligence, with interest in network metadata and critical communication routes. That explains why the document stresses administration-plane isolation, strong segmentation, and reduced outbound traffic from compromised hosts. In this case, the goal does not appear to be only visible intrusion. It also includes the ability to observe, catalog, and maintain presence during relatively short but repeated intervals, consistent with an infrastructure that rotates nodes every few weeks.

Colombia

Colombia is explicitly listed as a priority target since 2024. ColCERT includes it alongside Chile, Peru, Argentina, Brazil, and Venezuela in the victimology for the ORB3 campaign, and also mentions it in the mitigation and monitoring section. The risk for Colombia is concentrated in telecom operators, communications providers, and, by extension, critical infrastructure with poorly segmented connectivity. The alert highlights initial access via exposed servers, mass scanning, brute force, JSON reporting to C2, generic SSL or TLS certificates, and the wsprint.exe process as pieces to watch in local environments.

Colombia's relevance also appears in the tactical recommendation to monitor activity from the 103.97.203.0/24 block. ColCERT suggests monitoring and, where appropriate, blocking scanning or brute-force activity originating there. For defense teams, that means network telemetry and authentication logs should be correlated with source lists, failed-login patterns, and anomalous administration signals. The risk does not end with the outbound IP. It includes compromised credentials, exposed web consoles, and possible use of backdoors across Windows, Linux, or IoT.

Chile

Chile appears in the alert as one of the target countries of the ORB3-supported operation. ColCERT says telecom operators and communications providers in South America, including those in Chile, face HIGH risk. The text ties the country to the same attack chain seen across the region. That means initial compromise of exposed services, scanning and brute force against SSH, PostgreSQL, and Tomcat, plus automated JSON reporting and the use of generic certificates to mimic traffic.

The reference to Chile adds an important geographic detail. ColCERT attributes ORB3 obfuscation to outsourced nodes in India associated with ASN 136258, which helps hide the real origin of activity. For a technical reader, that means a connection that appears to come from a third party does not weaken the espionage hypothesis aimed at South America. If anything, it may be part of the concealment design.

Argentina

Argentina is explicitly included in the alert's regional victimology. ColCERT lists it among the countries targeted since 2024 by the ORB3-linked campaign, alongside Colombia, Chile, Peru, Brazil, and Venezuela. The source also includes Argentina when it explains that the infrastructure has been used to compromise telecom operators and communications providers in South America.

The most concrete value for Argentina is in the traceability of the attack chain. The alert describes initial compromises of Internet-exposed servers, followed by mass scanning and brute force against SSH, PostgreSQL, and Apache Tomcat, with JSON reporting to C2. It also mentions generic SSL or TLS certificates, reused and with fields such as C=US,CN=SERVER and C=US,CN=CA, along with the wsprint.exe process loading unsigned DLLs from C:\ProgramData. All of that translates into fairly clear hunting hypotheses for telecom and critical environments in Argentina.

Brazil

Brazil is included among the affected countries and appears more specifically in one of the expanded parts of the material. ColCERT says actors abusing the ORB3 network use zero-day exploits in edge devices and router firmware manipulation as part of their techniques against communications infrastructure in the affected countries, including Brazil. That raises the sophistication level attributed to the operation because it goes beyond credential abuse or automated scanning.

For Brazil, the sector risk again centers on telecom, with mobile operators, broadband ISPs, fiber providers, and backhaul networks, but the alert also extends exposure to energy, water systems, and transportation with poorly segmented OT. If the operation gains pivot access into communications infrastructure or edge equipment, the potential blast radius is larger than that of an isolated account intrusion.

Peru, Venezuela, Paraguay, Bolivia, and the United States

The material does not provide additional verified facts to build separate country sections for Mexico, the United States, Paraguay, Bolivia, or Peru beyond Peru's inclusion in the regional target set. The evidence does support saying that Peru is part of the list of target countries since 2024, but it does not add a deeper country-by-country level of detail.

Technical Indicators

The lack of hashes, domains, operational URLs, or additional file names in the material limits the construction of a broader IOC list. The technical value of the report is concentrated in infrastructure, processes, and observable ports, not in individually identified malware artifacts.

Analysis for Security Teams

The immediate priority for telecom and critical infrastructure is to treat this campaign as a mix of initial access intrusion, credential abuse, and cross-platform persistence. The sequence described by ColCERT suggests that the first thing to watch is Internet-exposed servers. If a public host starts showing scanning traffic, mass authentication attempts, or outbound connections to nodes tied to 103.97.203.0/24, the incident should be escalated immediately.

For network detection, it makes sense to correlate repeated attempts against SSH, PostgreSQL, and Tomcat with unusual outbound patterns to cloud infrastructure or to nodes using generic, reused SSL or TLS certificates. Automatic JSON reporting to C2 is another useful point. You do not need the exact message format to detect the logic, exploitation events and valid credentials firing in batches, with short gaps between discovery and communication. If that telemetry overlaps with multi-hop proxies or HTTPS-encapsulated traffic, the signal gets stronger.

For endpoint hunting, wsprint.exe deserves priority review when it loads unsigned DLLs from C:\ProgramData. The alert presents it as a potential compromise indicator, and that indicator should be handled together with backdoors such as TernDoor or PeerTime if EDR, inventory, or forensic validation is available. On Windows, the combination of a plausible process name, unsigned libraries, and network activity associated with the campaign gives a fairly consistent masquerading hypothesis.

Defense also depends on architecture. ColCERT stresses Zero Trust, strict segmentation of the administration plane, and OT isolation. That is not cosmetic. If the administrative network shares paths with user or production traffic, brute force against privileged credentials can escalate. If OT receives overly broad connectivity, actors can use that entry point to pivot and observe routes, configurations, and critical communications metadata. Phishing-resistant MFA reduces the value of credentials obtained through brute force or reuse, but it has to be applied to real privileged accounts, not just peripheral access.

Egress management is also key. ColCERT recommends blocking or sharply restricting outbound connections from compromised or high-risk hosts. That has direct utility against ORB3 being used as a C2 and exfiltration channel. If a telecom or critical-infrastructure server loses control of its outbound traffic, the operation can use it as a platform for attacks against others or as a relay for additional intrusions. Limiting that outbound path reduces both persistence and bounce capability.

For operational prioritization, the logical order is this. First, inventory exposed assets and check whether any public interface matches the class of server targeted in the alert. Second, look for authentication and reconnaissance telemetry over SSH, PostgreSQL, and Tomcat. Third, review Windows processes with wsprint.exe and unsigned DLLs from C:\ProgramData. Fourth, audit internal certificates and check for generic, reused, or unusually long-lived SSL or TLS. Fifth, review segmentation between administration, production, and OT, especially in energy, water systems, and transportation.

For monitoring centers, the 103.97.203.0/24 block should be integrated as a trigger, not as sole proof. The value of that network is high because ColCERT ties it directly to the infrastructure. However, the material also makes clear that node rotation is fast. For that reason, detection should not depend on a single IP, but on a combination of behavior, target ports, host artifacts, certificates, and traffic modeling.

Material Limitations

This analysis is limited to ColCERT's technical alert, Team Cymru's public reference to 16 active IPs, and the MITRE ATT&CK definitions cited in the source material. There are no hashes, additional domains, malware samples, YARA rules, or prior campaign names beyond UAT 9244. There is also no exhaustive victim list by country, no exact intrusion dates, and no exploitation details tied to a specific vulnerability.

Attribution also carries a level of caution. ColCERT describes the actors as espionage cybercriminals aligned with the People's Republic of China and assigns the operation to groups such as APT5, APT15, Famous Sparrow, and Tropic Trooper. That linkage comes from the source and should be preserved with the same level of precision, without extending it into a direct state attribution that the material does not state in that form.

On geography, the material allows for deeper coverage of Colombia, Chile, Argentina, and Brazil. For Peru, Venezuela, Paraguay, Bolivia, Mexico, and the United States, there is no additional verifiable evidence in the supplied corpus beyond general mentions or, in some cases, a complete lack of specific data. For that reason, an equivalent country-by-country assessment is not included for those cases.