China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Summary: Cisco Talos reports that a China-linked APT actor tracked as UAT-7810 is refining custom malware to expand LapDogs, an Operational Relay Box network first disclosed in June 2025, by compromising internet-facing networking devices. The actor has developed LONGLEASH as a successor to its ShortLeash backdoor, deployed at least four new servers hosting DOGLEASH variants, and used a Java-based backdoor called JARLEASH on at least one of three servers, exploiting known flaws in unpatched Ruckus routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and targeting ASUS AiCloud Routers vulnerable to CVE-2025-2492.
Bottom line: Talos assesses UAT-7810 builds this relay infrastructure for other China-nexus actors to use, and UAT-5918 has already drawn on it to attack critical infrastructure entities in Taiwan since at least 2023 - so unpatched routers on your edge may be conscripted into someone else's campaign.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-22653CVE-2020-22658CVE-2023-25717CVE-2025-2492
- Related
- CVE-2023-25717: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability Known Exploited Vulnerabilities · May 12, 2023Wrt Hug Exploits Six ASUS WRT Flaws to Hijack Tens of Thousands of EoL Routers Worldwide Cyber Risks ·University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026