Loading story…
Project ORBITAL, a new open-source intelligence initiative, has been launched to track and analyze Operational Relay Box (ORB) networks that advanced persistent threat actors use to hide command-and-control activity behind layers of compromised end-of-life SOHO routers and IoT devices. The project aggregates public reporting and telemetry from security vendors and U.S. government agencies into a centralized intelligence matrix and graph view, reflecting growing industry focus on ORB infrastructure as a durable method for obscuring attacker origin and blending malicious traffic with legitimate regional traffic.
The reporting says ASUS devices appear most frequently in public ORB disclosures, while the LapDogs ORB network has the highest number of reported targeted devices. It also identifies overlap in ORB usage among China-linked actors including APT15, UNC2630, and UNC5174, indicating some infrastructure may be provisioned by specialized teams and then shared or leased across a broader Chinese espionage ecosystem. The findings reinforce that ORB networks are no longer a niche tradecraft element but a standard operational security layer for multiple Chinese-linked intrusion sets.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
A report alleged that Guangdong Chanming develops offensive cyber capabilities for Chinese state customers and likely supplied RedRelay-related infrastructure to Chinese military and security entities. It also linked Guangdong Chanming and the FCN tool to WHIPWEAVE, a malware component of the RedRelay/ORBWEAVER covert network, and aligned the users with the APT15/Ke3chang cluster.
The Project ORBITAL analysis reported overlap in ORB usage among Chinese-linked actors including APT15, UNC2630, and UNC5174. It suggested some ORB infrastructure may be provisioned by specialized teams and shared or leased across the broader Chinese intelligence ecosystem.
Project ORBITAL's analysis identified ASUS devices as the most frequently targeted devices appearing in public ORB reporting. The same analysis found the LapDogs ORB network had the highest number of reported targeted devices.
Project ORBITAL was launched as an open-source intelligence initiative to track and analyze Operational Relay Box (ORB) networks used by advanced persistent threat actors. It aggregates public reporting and telemetry from security vendors and U.S. government agencies into a centralized intelligence matrix and graph visualization.
Trend Micro reported that the Sandworm-attributed Cyclops Blink botnet, previously known for infecting WatchGuard Firebox devices, was also infecting ASUS routers. The report described the malware's persistence in flash memory, modular architecture, and use of compromised routers as C2 infrastructure, with more than 200 victims identified globally.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcepylos.co
Open sourceteam-cymru.com
Open sourceblog.bushidotoken.net
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that **UAT-7810** is continuing to build and maintain its **LapDogs** operational relay box (ORB) network, using a growing malware toolkit to compromise internet-facing networking devices. Talos identified **LONGLEASH** as a new version of the previously documented `SHORTLEASH` backdoor, along with two additional malware families, **DOGLEASH** and **JARLEASH**, plus a testing utility called **LEASHTEST**. The activity primarily targets unpatched **Ruckus** wireless routers through known vulnerabilities, and researchers also linked one server to exploitation of **ASUS AiCloud** routers via `CVE-2025-2492`, indicating efforts to broaden the relay infrastructure. Researchers said UAT-7810 likely serves as an initial-access and relay-capability provider for other China-nexus espionage actors, including **UAT-5918**, while remaining a distinct cluster. Talos found four servers hosting payloads for **MIPS, ARM, and x64** systems, with **DOGLEASH** and shell scripts used to infect compromised Linux devices, and assessed with high confidence that the actor is China-nexus. The report also published infrastructure IPs, malware capabilities, detection signatures, and indicators of compromise to help defenders identify activity tied to the expanding ORB network.
Jul 14, 2026
Cisco Talos disclosed that **UAT-7290**, a threat actor active since at least 2022 and assessed with high confidence as part of the **China-nexus APT ecosystem**, has conducted sustained intrusions against high-value **telecommunications and critical infrastructure** organizations in **South Asia**, with more recent activity extending into **Southeastern Europe**. The group reportedly performs extensive pre-attack reconnaissance, then compromises public-facing edge devices through **one-day exploits**, proof-of-concept exploit adaptation, and **target-specific SSH brute force**, seeking deep and persistent access inside strategically important telecom environments. Researchers said the actor relies heavily on a **Linux-focused malware** toolkit that includes **RushDrop**, **DriveSwitch**, **SilentRaid**, and **Bulbature**, alongside overlaps with **RedLeaves** and **ShadowPad** and activity previously associated with **Red Foxtrot/APT10**. Talos assessed that UAT-7290 appears to serve a dual role: carrying out espionage while also acting as an **initial access provider** that converts compromised devices into **Operational Relay Box (ORB)** nodes for possible use by other China-linked operators. SilentRaid supports modular capabilities such as remote shell access, file management, and port forwarding, while Bulbature was tied to ORB infrastructure through a self-signed certificate observed on at least **141 hosts** in **China or Hong Kong**, reinforcing the attribution assessment.
Jun 29, 2026
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026