UAT-7810

UAT-7810 is a China-nexus advanced persistent threat actor focused on building, maintaining, and expanding Operational Relay Box (ORB) infrastructure, most notably the LapDogs network. Rather than being primarily associated with direct victim-end espionage collection, the group is assessed to function as an infrastructure and initial-access provider that enables other China-aligned actors, including UAT-5918, to route operations through compromised edge devices and obscure the origin of downstream activity. Talos has treated UAT-7810 and UAT-5918 as distinct clusters despite tooling overlap. The actor has shown a sustained preference for compromising internet-facing networking equipment, especially unpatched Ruckus wireless routers, and has also been linked to exploitation of ASUS AiCloud routers. Reported exploitation includes CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492. After gaining access, UAT-7810 repurposes compromised devices as relay nodes within ORB infrastructure used for proxying, tunneling, traffic redirection, intermediate command-and-control, reconnaissance support, malware delivery, and exfiltration support for broader China-linked operations. UAT-7810 maintains a bespoke malware ecosystem centered on router- and Linux-focused tooling. Known malware families and utilities include SHORTLEASH, its successor LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST. LONGLEASH is an evolved backdoor that supports reverse shell access, multi-protocol proxying, packet redirection, tunnel management, SMTP functionality, TLS/PKI handling, client authorization, and self-removal when tampering is detected. It can also operate as an intermediate C2 node forwarding commands and data between peers. DOGLEASH is a passive Linux backdoor capable of file operations, system information collection, shell command execution, and arbitrary shellcode execution in memory. JARLEASH is a Java-based administrative backdoor that provides web-based file management and can run FTP, SFTP, and Netcat services on compromised systems or actor-controlled infrastructure. LEASHTEST is a testing utility used to validate functionality on MIPS and embedded IoT platforms, reflecting active development for heterogeneous edge-device environments. The actor’s tooling has been observed across MIPS, ARM, and x64 architectures, reinforcing the assessment that UAT-7810’s operational objective is to convert routers, embedded devices, and related edge systems into durable relay infrastructure rather than merely achieve one-off code execution. Simplified Chinese comments identified in JARLEASH configuration data further support assessment of Chinese-speaking operators. UAT-7810 is best characterized as a China-aligned ORB builder and infrastructure enabler supporting long-term espionage logistics, concealment, and operational resilience for related threat activity.