Operational routing is the deliberate selection and control of the paths that cyber activity takes through intermediary systems such as proxies, relays, or compromised hosts. Instead of sending traffic directly from a source to a target, an operator chooses one or more hops to hide origin, distribute load, or avoid blocks. The route can be static, rotating, or changed on demand.
This matters because routing is part of the attack infrastructure, not just the payload. In espionage, scanning, command traffic, and data theft may all be relayed through multiple nodes so defenders see many sources instead of one. For defense, tracking unusual path changes, proxy use, and outbound connections from edge devices can reveal this layer. Disrupting operational routing can slow an operation, reduce anonymity, and force adversaries to rebuild their support network.