A relay chain is a sequence of systems that forwards network traffic from one point to another. Each system passes the traffic onward, making it harder to identify the original source from the final connection alone. In attacks, operators may route traffic through compromised routers or other internet-connected devices, sometimes rotating them to make the path short-lived.
Relay chains can complicate attribution and simple defenses such as blocking a single source IP address, because the visible address may belong to an intermediary rather than the attacker. They do not make activity impossible to trace: defenders can correlate traffic patterns, authentication and access logs, and endpoint evidence. Monitoring privileged and remote access, hardening exposed devices, and investigating unusual connections can help detect misuse. A relay device appearing in traffic does not, by itself, establish who controlled it or which systems were affected.