Loading story…
Cisco Talos reported that UAT-7810 is continuing to build and maintain its LapDogs operational relay box (ORB) network, using a growing malware toolkit to compromise internet-facing networking devices. Talos identified LONGLEASH as a new version of the previously documented SHORTLEASH backdoor, along with two additional malware families, DOGLEASH and JARLEASH, plus a testing utility called LEASHTEST. The activity primarily targets unpatched Ruckus wireless routers through known vulnerabilities, and researchers also linked one server to exploitation of ASUS AiCloud routers via CVE-2025-2492, indicating efforts to broaden the relay infrastructure.
Researchers said UAT-7810 likely serves as an initial-access and relay-capability provider for other China-nexus espionage actors, including UAT-5918, while remaining a distinct cluster. Talos found four servers hosting payloads for MIPS, ARM, and x64 systems, with DOGLEASH and shell scripts used to infect compromised Linux devices, and assessed with high confidence that the actor is China-nexus. The report also published infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise to help defenders identify activity tied to the expanding ORB network.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Talos assessed with high confidence that UAT-7810 is a China-nexus threat actor and described it as a provider of infrastructure and initial access for other China-aligned actors, including UAT-5918, while remaining a distinct cluster. This attribution update was included in the newly published reporting.
Talos disclosed a new SHORTLEASH successor called LONGLEASH, along with DOGLEASH, JARLEASH, and a testing utility named LEASHTEST tied to UAT-7810 activity. The report also published four infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise.
Cisco Talos reported that UAT-7810 is actively maintaining and expanding the LapDogs operational relay box network while continuing to compromise networking devices, primarily through known vulnerabilities in unpatched Ruckus wireless routers. Talos also linked one server to exploitation of ASUS AiCloud routers via CVE-2025-2492, indicating efforts to broaden the ORB network.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
blog.alphahunt.io
Open sourcecyberveille.ch
Open sourcesecurityweek.com
Open sourceinfosecurity-magazine.com
Open sourcebleepingcomputer.com
Open sourcedecipher.sc
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed that **UAT-7290**, a threat actor active since at least 2022 and assessed with high confidence as part of the **China-nexus APT ecosystem**, has conducted sustained intrusions against high-value **telecommunications and critical infrastructure** organizations in **South Asia**, with more recent activity extending into **Southeastern Europe**. The group reportedly performs extensive pre-attack reconnaissance, then compromises public-facing edge devices through **one-day exploits**, proof-of-concept exploit adaptation, and **target-specific SSH brute force**, seeking deep and persistent access inside strategically important telecom environments. Researchers said the actor relies heavily on a **Linux-focused malware** toolkit that includes **RushDrop**, **DriveSwitch**, **SilentRaid**, and **Bulbature**, alongside overlaps with **RedLeaves** and **ShadowPad** and activity previously associated with **Red Foxtrot/APT10**. Talos assessed that UAT-7290 appears to serve a dual role: carrying out espionage while also acting as an **initial access provider** that converts compromised devices into **Operational Relay Box (ORB)** nodes for possible use by other China-linked operators. SilentRaid supports modular capabilities such as remote shell access, file management, and port forwarding, while Bulbature was tied to ORB infrastructure through a self-signed certificate observed on at least **141 hosts** in **China or Hong Kong**, reinforcing the attribution assessment.
Jun 29, 2026
Project ORBITAL, a new open-source intelligence initiative, has been launched to track and analyze Operational Relay Box (ORB) networks that advanced persistent threat actors use to hide command-and-control activity behind layers of compromised end-of-life SOHO routers and IoT devices. The project aggregates public reporting and telemetry from security vendors and U.S. government agencies into a centralized intelligence matrix and graph view, reflecting growing industry focus on ORB infrastructure as a durable method for obscuring attacker origin and blending malicious traffic with legitimate regional traffic. The reporting says ASUS devices appear most frequently in public ORB disclosures, while the **LapDogs** ORB network has the highest number of reported targeted devices. It also identifies overlap in ORB usage among China-linked actors including **APT15**, **UNC2630**, and **UNC5174**, indicating some infrastructure may be provisioned by specialized teams and then shared or leased across a broader Chinese espionage ecosystem. The findings reinforce that ORB networks are no longer a niche tradecraft element but a standard operational security layer for multiple Chinese-linked intrusion sets.
Aug 14, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026