Loading story…
Cisco Talos reported that UAT-7810 is continuing to build and maintain its LapDogs operational relay box (ORB) network, using a growing malware toolkit to compromise internet-facing networking devices. Talos identified LONGLEASH as a new version of the previously documented SHORTLEASH backdoor, along with two additional malware families, DOGLEASH and JARLEASH, plus a testing utility called LEASHTEST. The activity primarily targets unpatched Ruckus wireless routers through known vulnerabilities, and researchers also linked one server to exploitation of ASUS AiCloud routers via CVE-2025-2492, indicating efforts to broaden the relay infrastructure.
Researchers said UAT-7810 likely serves as an initial-access and relay-capability provider for other China-nexus espionage actors, including UAT-5918, while remaining a distinct cluster. Talos found four servers hosting payloads for MIPS, ARM, and x64 systems, with DOGLEASH and shell scripts used to infect compromised Linux devices, and assessed with high confidence that the actor is China-nexus. The report also published infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise to help defenders identify activity tied to the expanding ORB network.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Talos assessed with high confidence that UAT-7810 is a China-nexus threat actor and described it as a provider of infrastructure and initial access for other China-aligned actors, including UAT-5918, while remaining a distinct cluster. This attribution update was included in the newly published reporting.
Talos disclosed a new SHORTLEASH successor called LONGLEASH, along with DOGLEASH, JARLEASH, and a testing utility named LEASHTEST tied to UAT-7810 activity. The report also published four infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise.
Cisco Talos reported that UAT-7810 is actively maintaining and expanding the LapDogs operational relay box network while continuing to compromise networking devices, primarily through known vulnerabilities in unpatched Ruckus wireless routers. Talos also linked one server to exploitation of ASUS AiCloud routers via CVE-2025-2492, indicating efforts to broaden the ORB network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourceblog.talosintelligence.com
Open sourcedecipher.sc
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed that **UAT-7290**, a threat actor active since at least 2022 and assessed with high confidence as part of the **China-nexus APT ecosystem**, has conducted sustained intrusions against high-value **telecommunications and critical infrastructure** organizations in **South Asia**, with more recent activity extending into **Southeastern Europe**. The group reportedly performs extensive pre-attack reconnaissance, then compromises public-facing edge devices through **one-day exploits**, proof-of-concept exploit adaptation, and **target-specific SSH brute force**, seeking deep and persistent access inside strategically important telecom environments. Researchers said the actor relies heavily on a **Linux-focused malware** toolkit that includes **RushDrop**, **DriveSwitch**, **SilentRaid**, and **Bulbature**, alongside overlaps with **RedLeaves** and **ShadowPad** and activity previously associated with **Red Foxtrot/APT10**. Talos assessed that UAT-7290 appears to serve a dual role: carrying out espionage while also acting as an **initial access provider** that converts compromised devices into **Operational Relay Box (ORB)** nodes for possible use by other China-linked operators. SilentRaid supports modular capabilities such as remote shell access, file management, and port forwarding, while Bulbature was tied to ORB infrastructure through a self-signed certificate observed on at least **141 hosts** in **China or Hong Kong**, reinforcing the attribution assessment.
Jun 29, 2026
Researchers have identified a previously undocumented botnet dubbed **AryStinger** that has compromised more than 4,000 legacy routers worldwide and repurposed them as attacker-controlled proxies for reconnaissance, tunneling, traffic interception, DNS tampering, and remote command execution. QiAnXin XLab said the campaign primarily targets outdated **RTL819X-based** devices, including **D-Link DIR-850L** and **DIR-818LW** routers, and also includes a newer Go-based variant aimed at NAS devices. Infections are concentrated in **South Korea** and **China**, with additional activity observed in **Sweden, Malaysia, and Singapore**. The malware exploits long-known flaws including `CVE-2013-3307` and `CVE-2016-5681` on older Linksys and D-Link hardware, while the NAS-focused strain has been linked to `CVE-2025-11837`. XLab reported that AryStinger communicates with command-and-control servers over HTTP/HTTPS using **Protobuf** with **XOR** encryption, establishes persistence through **Dropbear** or **gs-netcat**, and appears designed less for DDoS or cryptomining than for building covert attack infrastructure. Researchers said attribution remains unclear and urged organizations and consumers to replace end-of-life routers, update firmware, change default administrator credentials, and disable remote management.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that the Chinese-speaking intrusion cluster **CL-STA-1062**, assessed with high confidence to overlap with Cisco Talos' **UAT-7237**, conducted sustained operations across East and Southeast Asia from at least 2022 through 2025. In 2025, the group targeted Southeast Asian government entities and state-owned critical energy infrastructure, using web application exploitation, **ASPX web shells**, reconnaissance, lateral movement, and data exfiltration to maintain access and steal information. Investigators said the actors combined open-source tooling including **SoftEther VPN**, **VNT**, **yuze**, **Mimikatz**, and **JuicyPotato** with a newly documented custom .NET backdoor, **TinyRCT**. The malware supports command execution, file listing and exfiltration, screenshot capture, encrypted HTTP-based command-and-control, and a self-destruct feature intended to erase forensic evidence. Unit 42 also reconstructed an infection chain in which a malicious `chrome_setup.zip` archive used **AppDomainManager Injection** to load a malicious DLL, download `PerfWatson2.exe` from attacker infrastructure, and establish persistence through a scheduled task.
Jul 1, 2026