UAT-7810 Expands LapDogs ORB Network With LONGLEASH and New Router Malware

Cisco Talos reported that UAT-7810 is continuing to build and maintain its LapDogs operational relay box (ORB) network, using a growing malware toolkit to compromise internet-facing networking devices. Talos identified LONGLEASH as a new version of the previously documented SHORTLEASH backdoor, along with two additional malware families, DOGLEASH and JARLEASH, plus a testing utility called LEASHTEST. The activity primarily targets unpatched Ruckus wireless routers through known vulnerabilities, and researchers also linked one server to exploitation of ASUS AiCloud routers via CVE-2025-2492, indicating efforts to broaden the relay infrastructure.

Researchers said UAT-7810 likely serves as an initial-access and relay-capability provider for other China-nexus espionage actors, including UAT-5918, while remaining a distinct cluster. Talos found four servers hosting payloads for MIPS, ARM, and x64 systems, with DOGLEASH and shell scripts used to infect compromised Linux devices, and assessed with high confidence that the actor is China-nexus. The report also published infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise to help defenders identify activity tied to the expanding ORB network.