Oct 24, 2026 · 32 min
Cyber spies outsource the infrastructure behind their operations
The middlemen of cyber espionage. [Research Saturday]
Shared infrastructure makes cyber-espionage attribution harder, but it also creates defensive choke points that can disrupt multiple actors.
- 1A China-nexus infrastructure quartermaster supplies reconnaissance, proxy routing, and obfuscation services to multiple espionage actors.
- 2Commercial proxy and VPN access lets enablement companies operate like technical contractors without directly conducting every intrusion.
- 3Shared infrastructure complicates attribution while giving researchers and defenders opportunities to monitor, expose, and disrupt operations.
Don't miss
Rouse explains how shared infrastructure makes attribution difficult while creating a potential choke point for monitoring and disruption.
The brief
Damon Rouse of Lumen’s Black Lotus Labs describes an infrastructure quartermaster in a China-nexus state enablement model, where public-private trust helps expose shared cyber-espionage services.
The quartermaster builds and maintains infrastructure for other actors, using tools including Qscan, FastLabyrinth, QtRouter, and QtProxy against government, military, technology, biotech, telecommunications, and internet targets.
Commercial proxy and VPN access gives well-resourced enablement companies a contractor-like role: they can support multiple operations without being the only actor behind any one intrusion.
The reusable service layer blurs attribution because actors share infrastructure and reconnaissance patterns, yet that same overlap creates monitoring and takedown opportunities.
Rouse points defenders toward strong baselines for legitimate traffic and reliable perimeter and SOC logging, while researchers and law enforcement build cases from shared intelligence.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.