UAT-7810

UAT-7810 is a China-nexus advanced persistent threat actor active since at least 2025 that specializes in building, maintaining, and expanding operational relay box (ORB) infrastructure. It operates the LapDogs network of compromised routers and other internet-facing devices, providing relay infrastructure that obscures the origin of downstream cyberespionage operations. UAT-5918 is among the China-linked actors that use this infrastructure; the two groups remain separately tracked despite overlapping tooling. LapDogs denotes the associated network and campaign rather than a confirmed organizational subgroup. The actor primarily compromises unpatched Ruckus wireless routers through known vulnerabilities, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. Its malware ecosystem supports Linux and embedded systems across MIPS, ARM, and x64 architectures, allowing compromised devices to serve as proxies, encrypted tunnel endpoints, and intermediate command-and-control nodes. UAT-7810's custom toolkit includes SHORTLEASH and its successor LONGLEASH, the passive Linux backdoor DOGLEASH, the Java-based backdoor JARLEASH, and the LEASHTEST functionality-testing utility. LONGLEASH provides reverse shells, multiprotocol proxying, packet redirection, tunnel management, and forwarding of commands and data between network nodes. It also supports encrypted connections, client authorization, traffic masking, and self-removal when tampering or suspicious activity is detected. DOGLEASH supports shell commands, arbitrary shellcode execution, file access and modification, and operating-system information collection. JARLEASH supplies web-based file management and file-transfer services on compromised systems and actor-controlled infrastructure. LEASHTEST validates functionality on MIPS-based embedded devices. These tools sustain a distributed infrastructure layer for other China-aligned espionage actors.