Winning 54% of the time
Summary: Cisco Talos reports that the China-nexus threat actor UAT-7810 is expanding its Operational Relay Box networks with custom malware, exploiting known vulnerabilities in unpatched Ruckus and ASUS routers to deploy upgraded LONGLEASH and DOGLEASH backdoors. The newsletter also notes Sysdig's documentation of a first known 'agentic ransomware' case that was non-reversible like a wiper and still required a human to supply credentials, provision command-and-control and staging servers, and choose a victim.
Key Takeaway: UAT-7810 builds these covert proxy networks so other APT groups can mask their origins and route malicious traffic through seemingly innocuous nodes, creating a blind spot that bypasses traditional perimeter defenses for high-value targets.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026