relay networks

Relay networks are a key technique in modern cyber espionage, as demonstrated by the Ink Dragon cluster's use of compromised IIS and SharePoint servers as ShadowPad relay nodes. Instead of treating victims as simple data sources, attackers convert them into active command-and-control hubs, blending malicious traffic with legitimate HTTP behavior to evade detection. This approach maximizes stealth and survivability by turning each victim into a relay that forwards C2 communications. Discussions on WindowsForum cover how such relay networks operate, their implications for enterprise security, and detection strategies for Windows-based environments.